Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b69148c3dae2124…

MALICIOUS

PDF

76.7 KB Created: 2020-12-20 11:26:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c605734a3e7da587d160f2a6046d26bd SHA-1: 123e398e7aef7272251445e5f4185d34af15249e SHA-256: 1b69148c3dae2124af4cef6e36118d3244ee2e54a4819f038e89f0c8e01a5dd7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'PDF_SEO_LINK_FARM'. The primary external URL, 'https://traffine.ru/strik?utm_term=thank+you+in+anticipation+for+your+kind+consideration+meaning+in+urdu', suggests a phishing or spamming attempt. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a high likelihood of malicious intent. No scripts were extracted, but the structure and embedded links point towards a malicious document designed to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=thank+you+in+anticipation+for+your+kind+consideration+meaning+in+urdu
    • https://gokopawe.weebly.com/uploads/1/3/4/4/134493337/lanaxutodi.pdf
    • https://masejufubalabej.weebly.com/uploads/1/3/4/3/134388341/rikenefeve.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e5a173c5-5fdf-43a6-90c7-53e7a57449a2/84378674240.pdf
    • https://uploads.strikinglycdn.com/files/6476e6e3-2e24-49f1-8f93-29b62d1423d9/how_to_place_things_in_terraria.pdf
    • https://static1.squarespace.com/static/5fc6f6291a9b7f647934c66b/t/5fcbd50926a2be7f6def59e2/1607193865488/tebevanokalit.pdf
    • https://static1.squarespace.com/static/5fc115bd5e8e827d428ee316/t/5fc2fedc08845d0924eccb26/1606614749207/80606719810.pdf
    • https://uploads.strikinglycdn.com/files/1b54ea26-2b91-4f85-ab9b-cdfd45f24d1d/suxugolikapagiwizuvinu.pdf
    • https://s3.amazonaws.com/xarojapi/nios_d._el._ed_solved_assignment_in_hindi.pdf
    • https://uploads.strikinglycdn.com/files/fe2fcb7e-5f03-4bf8-966b-c9fd7fcafc02/87481247016.pdf
    • https://s3.amazonaws.com/kelukakeb/15942000118.pdf
    • https://uploads.strikinglycdn.com/files/bf0ab1eb-3243-4c80-ba6b-125ffe51d0d6/spark_plug_condition_guide.pdf
    • https://static1.squarespace.com/static/5fc54c3ec6d96458363f293e/t/5fcf3cc33fa051062b43450e/1607417028350/kamofogimisuvekowogamu.pdf
    • https://s3.amazonaws.com/wulotugadag/samsung_dryer_manual_dve45r6100c.pdf
    • https://static1.squarespace.com/static/5fc78fed5c272238a81ad988/t/5fcc6e32fe657040d58982d1/1607233076748/vusopojilezesoge.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ca6c.bin
40ce0bc9b113ef031639604f059b60aa9f1e41b097d60e75bfbf620cccc66306		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCA6C 2900 bytes
font_01_sfnt_off0000d4b0.bin
65d4c684f3f0e30805ab33a0311804f93237c314e11b1ae1e515a295cd746633		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD4B0 5652 bytes
font_02_sfnt_off0000e7d2.bin
d5a07eb4da58818b3aacbcda080b5577b136d89ed662eeadb412ea35e8c6ecae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7D2 11308 bytes
font_03_sfnt_off00010dfb.bin
99ddc6f5858eb134f8024171ebe717cbd02485c31471b921a5021903b5272953		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DFB 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.