Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ed7d58eafd6edd1…

MALICIOUS

PDF

61.1 KB Created: 2020-11-22 21:53:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 8b3110077686f44e80b608f8d013f439 SHA-1: 173bf3d9f8f366d792c76d293572375e55e19920 SHA-256: 1ed7d58eafd6edd1a76aecf2939208f1a318cd844f456355bcca6f660afefe68
222 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'traffking.ru'. The document also includes a large number of external PDF links, many of which are likely part of a link farm designed to manipulate search engine results. The ML classifier strongly indicates maliciousness, and ClamAV detection confirms this. The presence of a download button lure further supports a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=pdf+thinking+in+c%252B%252B In PDF document text
    • https://lizotolagodega.weebly.com/uploads/1/3/4/4/134495854/pulaz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374024/normal_5f88e7e3439cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464541/normal_5fa5a49c35262.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368246/normal_5f8ac9e3afe1c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/moduxanakuri/tcs_aptitude_questions_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a61639e-beca-4056-801d-9039ac6cc34a/zoxaj.pdfIn PDF document text
    • https://s3.amazonaws.com/fizup/prime_video_app_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3fe5ac7a-7580-4262-904a-b26202dbe532/46353785282.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/decabdc1-23f2-4ce2-bc19-adec7a0d04d6/y8_games_no_block.pdfIn PDF document text
    • https://s3.amazonaws.com/nisiwanolom/44267823196.pdfIn PDF document text
    • https://s3.amazonaws.com/desenaz/nagiw.pdfIn PDF document text
    • https://s3.amazonaws.com/turip/calculus_early_transcendental_functions_6th_edition_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b3fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB3FC 4832 bytes
SHA-256: 4aab33af20552b54cf5b67ea5bc37ad0dada557813009cac1228b02a0fa87cda
font_01_sfnt_off0000c47c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC47C 10404 bytes
SHA-256: ae5ba768f133b876c7dc5e4c38ee174638236589a4b560682e4f5c9d25362270

Open this report in the interactive analyzer, or submit your own file for analysis.