Malicious PDF — malware analysis report

Static analysis result for SHA-256 08c1e07f381b4a6c…

MALICIOUS

PDF

133.1 KB Created: 2020-12-16 21:48:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e69212da11f65d67a3b5825a28c83f63 SHA-1: ea1c166ea5ed5c1b7d10ea2bd1acb25994c8d569 SHA-256: 08c1e07f381b4a6ce31376ec2b81bfba6ccc762ba16279b45dc49b4c4fed1815
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to PDF files hosted on services like Weebly and AWS, suggesting a link farm or SEO spam operation. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and numerous external links are indicative of an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?utm_term=drawing+buildings+tips
    • https://lebidupevi.weebly.com/uploads/1/3/4/3/134319251/194477.pdf
    • https://jerefukixuludew.weebly.com/uploads/1/3/4/6/134686450/jawiridunav.pdf
    • https://cdn-cms.f-static.net/uploads/4385010/normal_5fb44f9cf0cb4.pdf
    • https://cdn-cms.f-static.net/uploads/4450890/normal_5fb9f102b5e71.pdf
    • https://cdn-cms.f-static.net/uploads/4413835/normal_5f95bd1157ed3.pdf
    • https://static.s123-cdn-static.com/uploads/4486193/normal_5fc5524f9199d.pdf
    • https://cdn-cms.f-static.net/uploads/4455658/normal_5fa43f8ca8678.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/nerugiraxura/steps_in_data_analysis_quantitative_research.pdf
    • https://s3.amazonaws.com/podawakumepewez/gowuneborururef.pdf
    • https://s3.amazonaws.com/wonoti/1847936635.pdf
    • https://static1.squarespace.com/static/5fc67c172e34347c706ae803/t/5fd05c85b8bf0379e608e070/1607490693989/zulavomufafuguwami.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4fbde18c5c478ef26058/1606373311295/33863507285.pdf
    • https://s3.amazonaws.com/zomuzigo/20226748290.pdf
    • https://static1.squarespace.com/static/5fc0cbc7c6d964583621a279/t/5fc0ffeaf81c9a2a0cc5bb9d/1606483949722/accounting_case_study_questions_and_answers.pdf
    • https://s3.amazonaws.com/tetenifeme/free_contract_bridge_card_game.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018d29.bin
68621e9ad165ecb1fd3e263605f1c368ef1746628d8fb71437090c559491e075		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18D29 16924 bytes
font_01_sfnt_off0001c02b.bin
f5a56eb6ec6d9126b1c9fb62bad172cf77256fd87902b4e0c837528daa6dbd12		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C02B 5012 bytes
font_02_sfnt_off0001d13b.bin
8536f2e6b8b034ae908f4055fe86843f027630ea69f4e6b63db0d75904e134ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D13B 11304 bytes
font_03_sfnt_off0001f768.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F768 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.