Malicious PDF — malware analysis report

Static analysis result for SHA-256 12e8faa1a4cdac94…

MALICIOUS

PDF

70.3 KB Created: 2020-11-26 01:13:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: ab727b4c7cbb5fa56233d9720e378caf SHA-1: 7a80ed095fc6238644caa492ad9df4da135f7519 SHA-256: 12e8faa1a4cdac94867208bc894afe1ee9f0d8a8cf960b74934c859f59c5d4e8
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for linking to known malicious redirector infrastructure. Additionally, it exhibits characteristics of a PDF SEO link farm, suggesting an attempt to distribute malicious content or phish users. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=unr+math+center In PDF document text
    • https://lixazasowab.weebly.com/uploads/1/3/4/5/134588429/mituruveg.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/98988673-71c3-443b-a969-d8fc652525eb/98064858463.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/85cfad6b-acbd-40b1-9311-1e87cccbc36c/origami_pigeon_can_t_slow_down.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5b03946-1521-49e2-ac90-46f481c72767/ecosmart_light_bulbs_walmart.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/350d8254-b0aa-4e49-8da3-e5b55f03418a/2010.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/57465ae3-c422-4c23-aad5-41e1207a3b21/30882687151.pdfIn PDF document text
    • https://s3.amazonaws.com/zuwimadaneb/schumacher_battery_charger_portable_12v_6_2_amp_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de2eb9ed-81f6-4004-9176-f5765dbab080/20190568901.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f8b9f10-6b5e-4900-8f6a-fbd3efae177f/vafumiwudesejoz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20d65a48-8867-4b92-ac5d-af3dc0618e41/gifugifi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aac04a24-ea7c-402d-bb91-a76b608528bc/sizeg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/736678c5-1630-4cea-8101-759cceaea7fb/94938117648.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b679f677-ab44-4fb5-b25b-46dbd9ee6968/19073122124.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ebd8d10-1d75-43f6-85dd-4f9fa3cf2dac/el_arte_de_no_amargarse_la_vida.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c6e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC6E8 4100 bytes
SHA-256: 9688da52c60501e434614e55d374f7ecef4c11c3aa77e8d81df6004da7e23b05
font_01_sfnt_off0000d56a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD56A 4820 bytes
SHA-256: 9d9f839d2cb2b22e46ae869c25bb6796d733552f50f8fad422f59dfa7b87e1fd
font_02_sfnt_off0000e5a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5A0 11376 bytes
SHA-256: 95f08155cf1185b6e3fe90bf0052ccfa8a1ea293b5eea331ddd37526b265f3ba

Open this report in the interactive analyzer, or submit your own file for analysis.