Malicious PDF — malware analysis report

Static analysis result for SHA-256 f99d9b322be6fb74…

MALICIOUS

PDF

43.1 KB Created: 2020-10-01 10:36:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: 07bb0a3fbca2c6b26afa8c4b28a7c6df SHA-1: e86a362b337bab8a3966e029eab5b48413fb1394 SHA-256: f99d9b322be6fb749a227e3bf65bcfb0dd0c2ba612d7ce1fe91e48eb4162187b
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=antonyms+worksheets+grade+5+pdf In PDF document text
    • http://files.beyondbonesapparel.com/uploads/1/3/0/7/130739190/9764716.pdfIn PDF document text
    • http://lilotu.eileenenwrighthodgetts.com/uploads/1/3/2/3/132303382/f7fd9f8f4740f95.pdfIn PDF document text
    • http://files.makeoverbathrooms.com/uploads/1/3/1/4/131437864/zojig.pdfIn PDF document text
    • http://files.sola13.jungw8.com/uploads/1/3/1/8/131856207/9002542.pdfIn PDF document text
    • http://jasufew.ross-wheeler.com/uploads/1/3/1/8/131856195/lejudijesatamol.pdfIn PDF document text
    • https://site-1036646.mozfiles.com/files/1036646/13341340911.pdfIn PDF document text
    • https://site-1038852.mozfiles.com/files/1038852/widanivedi.pdfIn PDF document text
    • https://site-1037204.mozfiles.com/files/1037204/mixajubusuzoresitosasir.pdfIn PDF document text
    • https://site-1036957.mozfiles.com/files/1036957/63393764061.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/7356766a-ed92-4d0c-9266-e0ad2029e3c9/gazopitosagajuvix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7a75977-2a03-4068-847a-707a5e1a8f6c/46209231878.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f329f026-26df-49a3-97cc-a7f33ab3a4dc/47650959584.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d848c40-0648-4dfe-8d2c-ab37965d30e5/mufubajuluwixobuxoni.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f1f2232-bf20-4f8d-a079-e630d1a934e2/59080908004.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70ebd5c0-f0a2-49da-95fb-9d890d780b08/41822989900.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006952.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6952 5792 bytes
SHA-256: 182efe3532a8af451d4aa0a501561866b9afcda7cbbef6ba83a719c72929b3bc
font_01_sfnt_off00007d01.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7D01 10160 bytes
SHA-256: b9db135e26be8961bfa3832be9d1e3e25de10196ab2e068e31d1bf944719f425

Open this report in the interactive analyzer, or submit your own file for analysis.