Malicious PDF — malware analysis report

Static analysis result for SHA-256 d710b8f0b690c9a5…

MALICIOUS

PDF

41.9 KB Created: 2020-09-30 14:41:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: 1497da7f5233a8c60d5580c19721a79f SHA-1: 9ebbe171e3e76e88afad93ecae11a7ad9ca5ec57 SHA-256: d710b8f0b690c9a574706a970cecf19b5288eaeeb1b272435676a21413ce8606
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=outline+of+the+book+of+daniel+pdf In PDF document text
    • http://xezomulu.optimisticliving.com/uploads/1/3/1/4/131437412/b4be0a82f11d8.pdfIn PDF document text
    • http://files.tasteandseebakery.org/uploads/1/3/1/3/131384249/99a61642d.pdfIn PDF document text
    • http://bijonim.wgct.org/uploads/1/3/0/7/130739802/462182.pdfIn PDF document text
    • http://wapomiko.liverpoolbeercollective.com/uploads/1/3/1/8/131856372/jolerom.pdfIn PDF document text
    • http://files.byzantineegypt.com/uploads/1/3/1/3/131398367/3801874.pdfIn PDF document text
    • http://wofitajir.valmcloughlin.com/uploads/1/3/1/4/131406970/95ac4.pdfIn PDF document text
    • http://files.batonrougehomeinspector.org/uploads/1/3/1/6/131606390/xutedetexajonu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b887a155-6ef6-4e31-b87f-a9fa2bd27374/14288579967.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/94eb4405-4ba8-4809-afb8-81e2d5ab8143/8002758718.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b99720df-474a-4fb8-903a-c7b288eaa9c9/sokexukolumetidovebevi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa60c25b-4cd3-4bde-ab1a-e091ea0c01cc/22760657530.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7979e5db-b77e-4292-b35a-a269f7c821f3/81264551342.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9269cd7-5b9e-4766-a53f-46da59c867a9/11446112365.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9ebadf1-3ecd-47f4-87c8-a5f548b99a67/tuwirobenufom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e4b2d99-4554-4d15-bbff-66d09aada086/sesuteterusonikejukolujo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x66EA 5088 bytes
SHA-256: 14ca6c3161a7c0e663f4c624cf588d81a135cb44f6c442dc39109ec14d708acf
font_01_sfnt_off0000782f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x782F 10180 bytes
SHA-256: f3cdcdfe9c64148c68fee81da1b41645a4bbaddea3d851a4747d9368af6ffa82

Open this report in the interactive analyzer, or submit your own file for analysis.