Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d7985612f6f94b4…

MALICIOUS

PDF

89.8 KB Created: 2020-12-25 01:36:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 711efa2662b738d67e7f3f86c630f17f SHA-1: be0302c9185299474d15e745cf2470e1d1db9a54 SHA-256: 1d7985612f6f94b4fe9f72aabc568557614faa8ecb26dedc8587840756924bfb
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, many of which point to other PDFs, suggesting a link farm or redirection mechanism. The primary external URI points to 'traffking.ru', which is suspicious. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution by redirecting users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/strik?utm_term=counter+terrorist+strike+3d+hack PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4457014/normal_5fc9b148ab7dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418570/normal_5f9b91ad54f9c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482002/normal_5fd70beee057e.pdfIn PDF document text
    • https://pexafibilo.weebly.com/uploads/1/3/4/4/134484824/kalaxez-papum-xejuzivu-zefidudozexosi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371023/normal_5fc5afe785307.pdfIn PDF document text
    • https://lavupujewefi.weebly.com/uploads/1/3/4/6/134631736/tafedari.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379387/normal_5fa953c6955af.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496374/normal_5fad7e4998ea5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464870/normal_5fa33f9f924a7.pdfIn PDF document text
    • https://fisupipegapug.weebly.com/uploads/1/3/4/5/134515512/goxevuvavomabelinoro.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421472/normal_5fc64816cb8a6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/2783ad8f-9f94-40c3-85c0-3f098bdb6f0d/xiwanidibas.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00011d24.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11D24 24876 bytes
SHA-256: 83fd51434e232e2a53896acb3a7e07b207d3fa87033453d51b6e739f7e1654cd
font_00_sfnt_off0000e637.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE637 5128 bytes
SHA-256: 05804f0aa0ec639c926a8c4bd8cbc73c20946ae18d8c1e4164bdc7f59d5d0d6f
font_01_sfnt_off0000f797.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF797 11340 bytes
SHA-256: c94a0a65d32bf766dfabe54705f31e6881593ab9323dbd92a15f92c0d9f51205
font_03_sfnt_off000149fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x149FD 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.