Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb3b994a37fa2c4d…

MALICIOUS

PDF

52.6 KB Created: 2020-10-25 05:49:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-02-23
MD5: 130c54d949048d7c1a39d56b39f1e3a1 SHA-1: 491060a33d97f6cc44019ae6aa1120701851a4f7 SHA-256: fb3b994a37fa2c4dacc0d893d75c809f170ac425a7dce44023abe384500b802e
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/aws?keyword=weekly+meal+planner+template+with+snacks+pdf In PDF document text
    • https://xogexemufak.weebly.com/uploads/1/3/1/4/131437987/9afa3facd.pdfIn PDF document text
    • https://megadezatesaram.weebly.com/uploads/1/3/0/7/130776649/a3d71.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c110b67-c1f6-41a5-89c3-0dab79b72530/zulaxuniluvekawaxivo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64922fce-dc0b-4651-b812-ef27fb1795b5/gunagozamatavavewuburapi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff3cb323-b7f6-47c1-8b6e-66fdf7980350/xasizetukebugofumabu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32d37d90-0b1e-4d2c-8496-117cd0899dcc/17767292647.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab90d3bb-9ba2-42e0-8b6a-cbfc43a48742/19879280467.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0486/5281/2456/files/wivixijidov.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0492/4676/5222/files/truly_madly_guilty_free_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/9603/9833/files/dog_bite_management_guidelines_uk.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/1108/2912/files/where_did_they_film_dantes_peak.pdfIn PDF document text
    • https://s3.amazonaws.com/ravuxudibure/bawunesomuxobapere.pdfIn PDF document text
    • https://s3.amazonaws.com/ravuxudibure/fokerofejutejoji.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/3120/2472/files/seora_en_ingles_crucigrama.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0488/1098/3589/files/college_algebra_crash_course.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/8810/1030/files/pokemon_gold_beta_rom_android.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/8766/8397/files/grand_theft_auto_v_apk_mod.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/4034/8586/files/salus_it500_user_guide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/8084/9852/files/progesterona_en_el_embarazo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/5789/5841/files/mta_signal_maintainer_exam_2020.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008a42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A42 5664 bytes
SHA-256: 8ff48409a48647a7bfcbc6f5004ac4779a52c1181b99b74fad1c47f2f074a908
font_01_sfnt_off00009d7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9D7E 11104 bytes
SHA-256: f977901251f4f66341c1e5ce9874d59446b3898b89fbef875a95a1b99c204f42

Open this report in the interactive analyzer, or submit your own file for analysis.