PDF malware analysis — malicious · fd2620c4358ad6fd

MALICIOUS

PDF

116.2 KB Created: 2021-03-17 02:15:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0d8111fb1afd9cb9b0dfda7332658c32 SHA-1: 98f1da72bafa1bdabe9fc1dfb8f1ff849aaed4f9 SHA-256: fd2620c4358ad6fdaf7c1b69e83f2344d2b04ba6af0b2ddb88d916598106fcdc

98 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9993

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
ClamAV scan did not complete info CLAMAV_SCAN_INCOMPLETE

ClamAV scan on this file did not complete (ClamAV error (exit 2)); the verdict reflects only static heuristics. The result is not cached so a later submission will retry the scan.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/wix?keyword=what+is+knoxville+tennessee+poem+about+love
- https://cdn.sqhk.co/jizapamilizo/gdicify/grocery_shopping_list_template_word.pdf
- https://cdn.sqhk.co/pulazapusaw/ghR7jet/wipodumiwatos.pdf
- https://cdn.sqhk.co/kixobaza/bhfjdfT/dire_wolf_hd_wallpapers_4k.pdf
- https://cdn.sqhk.co/wifopuzuxiba/gi32UV8/vovibokewename.pdf
- https://cdn.sqhk.co/xudadidi/nghtig9/cut_out_shapes_illustrator.pdf
- https://static.s123-cdn-static.com/uploads/4388814/normal_5fdebe4ecd3cb.pdf
- https://cdn.sqhk.co/mapiwoda/yiemOWT/learn_to_fly_idle_penguin_games.pdf
- https://cdn-cms.f-static.net/uploads/4478685/normal_5fd66163e2bd1.pdf
- https://cdn-cms.f-static.net/uploads/4458631/normal_6029724e55ee7.pdf
- https://cdn.sqhk.co/vojogalu/iiCgcKj/banting_green_list_2019.pdf
- https://cdn.sqhk.co/bebubofawa/5nheiht/xenokapajamupevu.pdf
- https://s3.amazonaws.com/rikolesafuwofar/70882329186.pdf
- https://46a1ac71-481d-4a85-b709-d40f3a189542.filesusr.com/ugd/143c98_fc9927aa1a1140ca9cc726b45459865b.pdf?index=true
- https://551f0ad2-75d1-4009-b90b-2f3e3e20230b.filesusr.com/ugd/c2bf0a_f74a5985ac2e44498dc5dd1b55ee37d3.pdf?index=true
- http://sepojofapu.rf.gd/mass_air_flow_sensor_test.pdf
- https://s3.amazonaws.com/rewepalazamiso/regesofeda.pdf
- https://s3.amazonaws.com/jojitagifuva/tuteno.pdf
- http://muwiliwus.epizy.com/choir_guy_sebastian_piano_sheet_music_free.pdf
- https://77da94c0-0f0a-445b-87af-e489a0b5ef66.filesusr.com/ugd/db1da1_1c00a92ba2ee47be872d2907c0cb9efa.pdf?index=true
- http://notewajojop.rf.gd/how_to_quit_drinking_without_having_withdrawals.pdf
- https://s3.amazonaws.com/lososimap/investigative_report_memo_format.pdf
- https://19508648-7f28-415f-8121-b57715dc1465.filesusr.com/ugd/9734e7_f7ba1d459de6408ab4c37e40a77c0a37.pdf?index=true
- https://770ad53b-b55e-4e58-b1eb-3709f41304f7.filesusr.com/ugd/98e298_e8567339b7cf44e79224350c28211461.pdf?index=true
- https://s3.amazonaws.com/zaxawetawupo/93429165152.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Open this report in the interactive analyzer, or submit your own file for analysis.