PDF malware analysis — malicious · e505b5276a5a9715

MALICIOUS

PDF

39.9 KB Created: 2020-11-09 09:13:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-03-01

MD5: c28437643247500e5034c9018d9b408e SHA-1: b51b0cd0b732709afebb82b0f60f06995e48b351 SHA-256: e505b5276a5a9715c1a00ffa7d55e2c4f270e86ee3d113f8be65bd3c699f9f4d

76 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/123?keyword=escaping+the+prison+secret+medal PDF link annotation
- https://dimejozetef.weebly.com/uploads/1/3/1/0/131070151/782a2f4862dfb16.pdfIn PDF document text
- https://girejegi.weebly.com/uploads/1/3/4/4/134490844/zukuwexufa.pdfIn PDF document text
- https://tujebikofo.weebly.com/uploads/1/3/4/3/134359874/jawezaduwimazorok.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402948/normal_5f93fe2c60af3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373987/normal_5fa3126e42286.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382631/normal_5f97ebe0259e0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375358/normal_5fa31c07c6a8f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420905/normal_5fa0121fb050a.pdfIn PDF document text
- https://fikifiwokadekaw.weebly.com/uploads/1/3/4/5/134585034/9ed03cf0914c31a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/gateme/andover_mills_rug_pierce_beige.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/be6f67e9-e802-48c3-826b-67377a2f4794/53439898675.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005c4a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5C4A	5444 bytes
SHA-256: `fc0ec797161cbae6a4be4312a182fa49f2926e2910b3f5df6ad89bea115bc852`
`font_01_sfnt_off00006ea4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6EA4	10748 bytes
SHA-256: `18da6a67cefee57f1540a4f8e5b6ad6aae22a52655c0f35470ec888399ca5677`

Open this report in the interactive analyzer, or submit your own file for analysis.