Malicious PDF — malware analysis report

Static analysis result for SHA-256 07a39d2384954f0b…

MALICIOUS

PDF

106.3 KB Created: 2020-11-17 23:42:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c38313513084abe5f71225dc23152f5 SHA-1: d36fc184fa32b2988015a2bba712f863bdfcf070 SHA-256: 07a39d2384954f0bb56ccc740d636d8f0e80c0635311f9653a90129ff4e65f17
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. The PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external links, with the primary suspicious URL being https://traffnew.ru/123?utm_term=vidas+secas+pdf. The document body is heavily obfuscated, but the presence of embedded URLs and the link farm heuristic suggest a phishing or SEO manipulation attack. No scripts were extracted, but the PDF structure itself is used to host these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=vidas+secas+pdf
    • https://zaronubiguxade.weebly.com/uploads/1/3/4/6/134685024/vomosi-dorafediki.pdf
    • https://repemigikaji.weebly.com/uploads/1/3/4/6/134608024/3947931.pdf
    • https://niwejeru.weebly.com/uploads/1/3/4/3/134308800/nixitegilamije.pdf
    • https://tezadogiva.weebly.com/uploads/1/3/4/5/134522012/rilida.pdf
    • https://rugeponejap.weebly.com/uploads/1/3/4/4/134487210/zuvugegipedam.pdf
    • https://cdn-cms.f-static.net/uploads/4377407/normal_5f8ffe86dc8cc.pdf
    • https://faxitovi.weebly.com/uploads/1/3/4/3/134379512/xepajuzibuf.pdf
    • https://vowijavig.weebly.com/uploads/1/3/4/3/134319359/lanukipanuze-jisezekofuwasi.pdf
    • https://gozajajemitala.weebly.com/uploads/1/3/4/3/134325553/569f1a66332.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/votuweroxigezog/hollywood_sign_deaths.pdf
    • https://uploads.strikinglycdn.com/files/c407145a-3c87-4efd-920a-2e4e87531457/19964442108.pdf
    • https://s3.amazonaws.com/naxizugenabi/33948854639.pdf
    • https://s3.amazonaws.com/mijedusovineti/isaiah_berlin_espaol.pdf
    • https://s3.amazonaws.com/zebarufuridorur/jarewovubajenijogoxejuwi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off00016c61.bin
b6dfc05693c74d5fbaab6c7a0a9ecded680df22d00c7e6d33cedf2f2482511f5		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x16C61 19264 bytes
font_00_sfnt_off0001003c.bin
da66580ef72d3458d11477dbb98f9e62abbc1f5e6f3c3283778d645f23402bf7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1003C 9344 bytes
font_01_sfnt_off00011fc4.bin
aea684872172e2ced95b74a257d186e6004401ab16f7c1a6b4aef2bd6ed177f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FC4 4476 bytes
font_02_sfnt_off00012efa.bin
4e47a1cfec9eae10c5ef3f9d0a936055406f02ce602d7b15d9f7102e4da8f58d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EFA 5672 bytes
font_03_sfnt_off00013d07.bin
c4d9f16f24c562375283fdba5e7a00c25e3b504a00b7a1fdc16e1d649c63bc53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D07 14916 bytes
font_05_sfnt_off00018ba7.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18BA7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.