Malicious PDF — malware analysis report

Static analysis result for SHA-256 0bfe75b7d4629a52…

MALICIOUS

PDF

69.4 KB Created: 2020-11-25 21:57:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 978e6e1cf3ad6b79cd537c9f9eab7f67 SHA-1: 062469e5c73e19f2a94753c6a20d5ad72655469e SHA-256: 0bfe75b7d4629a52a27f649af7ed4b8e3d432e1aa4acce6955523517a17b533e
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating a mass external PDF link farm, with one of the primary links pointing to 'traffking.ru'. Although the document body is heavily obfuscated, the presence of this URL and the ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggest a phishing or malicious redirection attempt. The PDF structure itself is also flagged for containing numerous external links, further supporting the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=hamilton+beach+slow+cooker+recipes+pulled+pork PDF link annotation
    • https://xapabareduvan.weebly.com/uploads/1/3/4/3/134395213/bezadoduxola.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nijudow/sat_chemistry_practice_test_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/rejiner/jixujevuxazak.pdfIn PDF document text
    • https://s3.amazonaws.com/luramamelolem/radial_engine_solidworks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/679c5487-565f-43d0-8140-9638b94a666b/roatan_islas_de_la_bahia_real_estate.pdfIn PDF document text
    • https://s3.amazonaws.com/wogikokuzotaxa/61397285605.pdfIn PDF document text
    • https://s3.amazonaws.com/podawakumepewez/majoras_mask_all_characters.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbd32db1-a342-4daa-ba67-532c3fff56c5/fozexupebudizitud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7cabe3f3-2148-4b74-999d-4b20f436f002/fuguwuruxuwavoguj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f7a0db0-d05a-4474-9882-88dd5e2e8d90/97831271372.pdfIn PDF document text
    • https://s3.amazonaws.com/nilititonawafim/64222848230.pdfIn PDF document text
    • https://s3.amazonaws.com/zabevog/similes_and_metaphors_worksheets_6th_grade.pdfIn PDF document text
    • https://s3.amazonaws.com/midizaxopazeji/caller_id_app_for_android_phones.pdfIn PDF document text
    • https://s3.amazonaws.com/liwafo/1205752052.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4964fa5b-ddfc-4f82-b316-033d50fbe64d/mefepav.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD2B7 5572 bytes
SHA-256: 436c19cbdb378407422fef48e994b3c80bf8a30f7088e373997fd12da3d6148d
font_01_sfnt_off0000e57f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE57F 10280 bytes
SHA-256: f5cd9a52fe80b51b318ad1a93b7e9e6fb25e106e35e9bc9bb60ea62debdcfc0a

Open this report in the interactive analyzer, or submit your own file for analysis.