PDF malware analysis — malicious · db09b1ab7ef4c987

MALICIOUS

PDF

43.7 KB Created: 2020-10-26 01:03:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-25

MD5: 0a41b4d4fe26e56437a71539c3a5f8c8 SHA-1: 572e350d28598e40ce5755b8259ffa532050e9c1 SHA-256: db09b1ab7ef4c9872c61edcf5a7f022a3d204e8dd1cd89ac3c36156a62656b4d

184 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/aws?keyword=breath+holding+spells+treatment+pdf In PDF document text
- https://posolefuriw.weebly.com/uploads/1/3/4/3/134374222/5f139985601.pdfIn PDF document text
- https://xibogunef.weebly.com/uploads/1/3/1/3/131398295/ninojafuduzobofiji.pdfIn PDF document text
- https://tedumuwoke.weebly.com/uploads/1/3/1/3/131397970/1803763.pdfIn PDF document text
- https://pavowojavujide.weebly.com/uploads/1/3/1/3/131398322/3b5b465.pdfIn PDF document text
- https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/7b44f697c7b.pdfIn PDF document text
- https://rofetidol.weebly.com/uploads/1/3/4/3/134322454/2aba5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366401/normal_5f876d7f2538d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367286/normal_5f8c7db9dd100.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371790/normal_5f88b185660ce.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371247/normal_5f8be93d51096.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372361/normal_5f88cdb550d8e.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/bawalidamovidud/82118107148.pdfIn PDF document text
- https://s3.amazonaws.com/wilugugo/tuxovisetisorumirurakupud.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/9273/0275/files/metupo.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0479/6189/9171/files/waxinupakagaburadidigi.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/2804/4698/files/boy_scout_orienteering_first_class.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006a2a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A2A	5504 bytes
SHA-256: `bf435bd6a7d26c1314cd719af178c4c9e7568ce0d55910ffd6913a75e8fe934b`
`font_01_sfnt_off00007cbb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7CBB	10744 bytes
SHA-256: `29beb65676ab2e4ba2bcaaf4fc2a074034c2aae073b72e2a13538a9a1bbab447`

Open this report in the interactive analyzer, or submit your own file for analysis.