Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc26facee21bb994…

MALICIOUS

PDF

45.3 KB Created: 2020-10-09 21:50:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 61d55620edddbdd955ca871aa57c3848 SHA-1: e971eef7197052d1279b5a8a746431d4230ca51e SHA-256: fc26facee21bb994b329405981d667c4ee5121f5a4a1c1d06165669380ad917d
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=complex+numbers+coloring+worksheet+answer+key In PDF document text
    • http://files.abstractartandyoga.com/uploads/1/3/2/6/132682076/livagaxux.pdfIn PDF document text
    • http://files.saintsscience.com/uploads/1/3/2/8/132814544/eab16b9a219b.pdfIn PDF document text
    • https://site-1039830.mozfiles.com/files/1039830/32788434243.pdfIn PDF document text
    • https://site-1037054.mozfiles.com/files/1037054/22832091567.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/b96c1732-a44b-46c8-bd7b-d52ad59f4dd3/54041696433.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2844ee0e-23ce-4bf7-b1ec-80211ec3b7e3/zifagojomuvu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ea4ac29-1b40-4322-b264-6835f818fb09/71362730235.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73b26682-eb86-4df3-90a8-ce71590bd51f/jaleponab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb4b4c5a-a35a-4607-9ac4-4118eda3638f/76022075293.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/517d7915-236c-4bcf-9ad4-1a98b9696149/setika.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ebc5c9f-65d0-41d0-b8ec-368b3ca18d7f/18524003422.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000511d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x511D 5716 bytes
SHA-256: b5770435c7553a85a04e9dd2a9e8c7fd49369530816fe54c4d82217535f345f9
font_01_sfnt_off00006475.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6475 6636 bytes
SHA-256: 4b352ed1f894b02604c6fc264c6d230b05db6e39f239c2c376847a5d96bf1d97
font_02_sfnt_off0000760f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x760F 10448 bytes
SHA-256: 673286401f3fcd06acc4eb89ad7af7dc0f6b927bc272875f2591802964ca098e
font_03_sfnt_off000099b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x99B6 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.