Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b30a189f5562e5f…

MALICIOUS

PDF

139.1 KB Created: 2020-12-09 21:57:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 4b2306373a0787a0785d7b4c1dc25270 SHA-1: 1ae028592ce41aed7f91da1bce1048d903833011 SHA-256: 0b30a189f5562e5f08e16c2f7b0d7f6232e1b947b6347d338e34a835183d567a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO poisoning and phishing. One prominent URL, 'https://trafffi.ru/aws?utm_term=the+new+encyclopaedia+britannica+15th+edition+pdf', appears to be the primary lure. ClamAV detection as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0' and ML classification strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=the+new+encyclopaedia+britannica+15th+edition+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4417653/normal_5f99627638212.pdfIn PDF document text
    • https://sepenunaxob.weebly.com/uploads/1/3/0/7/130776074/dixosuxazobek_xifasa_batazunexowa_kabupavili.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc2eaac5e8e827d429b0bf6/t/5fcee08c7cc0b10a0ac1e1ce/1607393421810/alchemy_classic_mod_apk_unlimited.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5933e8787e879898ba58f/t/5fca91bafdef016eae85b76a/1607111098822/gifakujeturomujuz.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5850fa5bc066edfc4d8cb/t/5fced00b1b45e152edb59773/1607389199580/marketing_strategy_definition_tutor2u.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4c63627a199023ace4336/t/5fc853b6e101942bf76ce2e1/1606964152510/audio_spectrum_maker_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45943591-d7f7-4e3c-b9e6-067e3f038e2e/94967212424.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb867307-c5c0-4d67-9361-2d5ab0c99260/audi_rs3_price_2015.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc512c9bf71053ccb2aa307/t/5fcce1a55177ea328cc1d1e2/1607262630481/11st_in_lbs.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0f5a79c08c7f2ba14ad0/1606225763703/vaxomix.pdfIn PDF document text
    • https://s3.amazonaws.com/jamokaroxoj/70674212066.pdfIn PDF document text
    • https://s3.amazonaws.com/widiku/nagibikorutu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcfb6cedabee7b440756d1/1606220652229/stellar_evolution_worksheet.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce5336190b057dd3805866/t/5fd10d7f1f86e027fbae8c04/1607536000245/81177862216.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0ed17f7cf8c75402b0ccf/t/5fc125579b1ed03538049ed1/1606493533351/81386113086.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0dfb492c50b1a1e776e0c/t/5fceedd21a78ee5f0159a862/1607396819262/19320805456.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d398.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D398 2856 bytes
SHA-256: 2cdd336d4ad4698270d9077a3b8ade5aca6d4decd0916d5d918882b18b5a1806
font_01_sfnt_off0001ddc3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1DDC3 5524 bytes
SHA-256: 4ae9c59f7f58e2c3af1e63ba8a64fb61cf60f5181693ba0986cf31afbc25f482
font_02_sfnt_off0001f0a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F0A4 13360 bytes
SHA-256: a7310dd6a97ac2dd460f5e171731f97f48f2bd03dc9ad32ceb812469fd83e9ec

Open this report in the interactive analyzer, or submit your own file for analysis.