Malicious PDF — malware analysis report

Static analysis result for SHA-256 10a2ab2226579471…

MALICIOUS

PDF

73.5 KB Created: 2020-12-29 13:57:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ec437fa34e402be341d7306215b45020 SHA-1: 1d9cf5e91a8e02c139991934e465f54378c04c92 SHA-256: 10a2ab22265794712e23933707fd5ea10e58a5fa3bd4f2ae3232ee2ad42830cc
254 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous links, with one identified as a known malicious redirector. A critical heuristic also indicates a lure to execute commands via the clipboard, suggesting an attempt to trick the user into running malicious code. The ML classifier strongly flags this PDF as malicious, and ClamAV confirms detection as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/strik?utm_term=cyberpunk+camera+filter
    • https://cdn-cms.f-static.net/uploads/4413370/normal_5fa4299640b4f.pdf
    • https://lixubirenolona.weebly.com/uploads/1/3/4/6/134669397/ragebipakojijex.pdf
    • https://judirarizase.weebly.com/uploads/1/3/4/6/134645007/5821063.pdf
    • https://static.s123-cdn-static.com/uploads/4446395/normal_5fe1b70cb0c87.pdf
    • https://kedixusivazusug.weebly.com/uploads/1/3/4/8/134869684/2749545.pdf
    • https://cdn-cms.f-static.net/uploads/4369146/normal_5f94b0a22f9ad.pdf
    • https://cdn-cms.f-static.net/uploads/4366024/normal_5f87fdbbcbd2b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/natewared/it_all_belongs_to_you_lyrics.pdf
    • https://s3.amazonaws.com/jemazejodep/mivikizonudefuf.pdf
    • https://uploads.strikinglycdn.com/files/11731ea2-a4d3-41e6-a376-7fe65b70a40f/jean_rouaud_les_champs_d_honneur.pdf
    • https://s3.amazonaws.com/dutuzanob/west_elm_linen_sheets_care.pdf
    • https://s3.amazonaws.com/xefejevife/nembutal_for_sale_in_malaysia.pdf
    • https://uploads.strikinglycdn.com/files/14c2f51d-0568-40d7-bf50-9343efaffd85/gunubu.pdf
    • https://s3.amazonaws.com/purixifusipelid/como_se_escribe_informante_en_ingles.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7d6.bin
4b73720186494dec9d53c83d063dbe9810ae3bc8960ef96d6af7bfa3d8aa73e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7D6 5192 bytes
font_01_sfnt_off0000e96e.bin
246569b5fd7226bd0ebf3c016de7ba0bf82e996896d660a08030b2af0a08efd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE96E 1936 bytes
font_02_sfnt_off0000f2af.bin
a2af3a794f80a66c4c017960560be6b1990e9b5922ff9378fad0b6c7f62ea662		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2AF 11144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.