Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0d4a670883261f6…

MALICIOUS

PDF

71.1 KB Created: 2020-10-15 06:15:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 3c33fe60e5766f1fdaae689b4fa415f7 SHA-1: 29abfb731eabe72ff0acccfe63ca5253d1b4b88e SHA-256: f0d4a670883261f6fd16fbcf0077e79a55c25913e0224c5937d673d4de642682
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?keyword=democracy+and+good+governance+in+africa+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4366976/normal_5f87ac019fa00.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365546/normal_5f8756320536d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368229/normal_5f8767da11471.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366654/normal_5f8749e13a19f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368244/normal_5f8764e8372ee.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367919/normal_5f87b2152e8e1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367642/normal_5f8749ffbf7ab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366377/normal_5f8777bfa63b8.pdfIn PDF document text
    • https://dojulukasinu.weebly.com/uploads/1/3/0/7/130776790/2706857.pdfIn PDF document text
    • https://xazapadikud.weebly.com/uploads/1/3/1/8/131871762/21c65.pdfIn PDF document text
    • https://mupibidegupek.weebly.com/uploads/1/3/0/8/130874042/c3ab2a8.pdfIn PDF document text
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/10610.pdfIn PDF document text
    • https://kenilajapa.weebly.com/uploads/1/3/1/0/131069910/764342.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0798878e-8cba-4ac4-9d6f-ef00eacc8614/45074512713.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c40465f-bc1a-4827-b628-5df72c9d80a7/83359405304.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aebbebc8-1add-4107-8804-f7be48069e68/36191639258.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5bd4072-710e-44b8-90b1-ef532f6e5ca3/wopamonifobisuz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b25a68b-b75d-491c-9f23-fc2e00a4d190/79261091100.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eeb2f880-37db-4dd8-8514-493fa8f4c972/ribolabovi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ab5061a-1c25-42bb-9b26-505d6cb5852a/91479270647.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af499afb-ae11-4bfa-a44c-a51940e48de7/nekozaf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc47f3fa-8ff0-41b1-80f8-3d7952a805d2/96814090613.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06083203-736c-4e91-bab8-0d224b8fd195/79761863802.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d81a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD81A 5428 bytes
SHA-256: 759571133d15c86f1cd48b230d8d86871e938d57f4d01bb04f718a1be6db7392
font_01_sfnt_off0000ea8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA8E 10580 bytes
SHA-256: 11564e75d4e87008c96c387eb0f5e718cfb82b84bec4a4bfe8701690e5b70941

Open this report in the interactive analyzer, or submit your own file for analysis.