Malicious PDF — malware analysis report

Static analysis result for SHA-256 21153f3a4b665dca…

MALICIOUS

PDF

68.1 KB Created: 2020-12-23 02:31:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0952df10f3c397192491a4433f526c2c SHA-1: 334f2e74fba1199f2a137ad2bc53c74af152846c SHA-256: 21153f3a4b665dca181b16296f71ecb9b69dc7a151fa9bc43199b1d22650f8db
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, identified as a link farm, pointing to various URLs. One prominent URL, 'https://trafftec.ru/strik?utm_term=help+the+guy+subway+fun+run', is flagged as suspicious. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution through these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=help+the+guy+subway+fun+run
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/7775416.pdf
    • https://tezadogiva.weebly.com/uploads/1/3/4/5/134522012/3534782.pdf
    • https://kijomexed.weebly.com/uploads/1/3/1/0/131069838/jasesuwawo-sepuwizaviw-mugixotos-xemaja.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e4996f1a-9931-4d28-9690-98b1548436ed/facts_about_striving_for_accuracy.pdf
    • https://uploads.strikinglycdn.com/files/11124a20-dd58-45a2-92ff-faf02978e116/49961492215.pdf
    • https://static1.squarespace.com/static/5fe1498ecf529e5ed05663cf/t/5fe18feee77a3c5c7edfbe93/1608617969160/2862310817.pdf
    • https://uploads.strikinglycdn.com/files/21d4e640-3c2a-48a9-9725-35dac1a45649/19448236974.pdf
    • https://uploads.strikinglycdn.com/files/df6071f1-ee30-4a8f-bc46-2d032b5b0583/43317520528.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4d8d145a8629dca75fd8/1606372750291/air_pump_for_air_mattress_amazon.pdf
    • https://uploads.strikinglycdn.com/files/a070797e-3e04-4f56-bf19-e051375e10b5/daluxawok.pdf
    • https://static1.squarespace.com/static/5fc0d12c3dfdd95b60d4a66f/t/5fc31924fa04221c718604a8/1606621477118/xitila.pdf
    • https://static1.squarespace.com/static/5fdd363137a75c289d58a145/t/5fdd9d23c18bd5077c8e3076/1608359203703/english_love_break_up_songs.pdf
    • https://static1.squarespace.com/static/5fc2a453cd1e280355df5d9e/t/5fcb8bc7b6b7366152fa8f5f/1607175111897/zikapolibek.pdf
    • https://uploads.strikinglycdn.com/files/458d7537-7a71-4e0b-be36-a7c774884141/brillion_cultipacker_seeder_for_sale.pdf
    • https://uploads.strikinglycdn.com/files/45cfb0f8-b25f-4083-ab24-fc266c90f1db/goxusabupuwetigatuluzof.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc49.bin
c21371b8b770e3317b801addc43c75db1c86843eeafeed9e25aab453eecf2b93		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCC49 5456 bytes
font_01_sfnt_off0000deec.bin
34dcafbb822d8f5ff47d5da97248c86377a719dc9013f89b41f4161da471d28d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEEC 10900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.