Malicious PDF — malware analysis report

Static analysis result for SHA-256 282b0c46921d9c44…

MALICIOUS

PDF

75.2 KB Created: 2020-11-16 12:20:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 0fc3710b1c058d986c58a82580bcf75c SHA-1: b31d496ee12ed96aa3ba1edf576581bbff9ede34 SHA-256: 282b0c46921d9c4476265f1c170708380ecd48c1051874731dc42b0e020a61ee
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is identified as malicious by ClamAV and an ML classifier, with critical heuristics indicating it contains a large number of external links, a common tactic for phishing or SEO spam. The embedded URLs point to suspicious domains, suggesting an attempt to redirect users to malicious content. While no scripts were explicitly extracted, the PDF structure and heuristics strongly suggest it's designed to exploit users by directing them to external, potentially harmful, websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=stephen+robbins+motivation PDF link annotation
    • https://rudofodirofebas.weebly.com/uploads/1/3/0/7/130739781/72e56.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368500/normal_5f87bad098485.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409619/normal_5f95f53c8e8d4.pdfIn PDF document text
    • https://rezivunafotete.weebly.com/uploads/1/3/4/3/134354631/mexab.pdfIn PDF document text
    • https://repafajekojila.weebly.com/uploads/1/3/4/3/134305679/nobifagekesufavofu.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ed5dfc5-890d-4608-bd4b-bc044934840c/99952744765.pdfIn PDF document text
    • https://s3.amazonaws.com/wejuvono/nagago.pdfIn PDF document text
    • https://s3.amazonaws.com/baritexovopa/watermark_adobe_pro.pdfIn PDF document text
    • https://s3.amazonaws.com/vaxebisapesi/pathfinder_race_creation_guide_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/piwanisaj/pimivewosujoti.pdfIn PDF document text
    • https://s3.amazonaws.com/lovetijif/gotefakurofadel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16ac3f23-7121-4ae1-96a5-13dbcf1b2ffb/great_songs_of_the_church.pdfIn PDF document text
    • https://s3.amazonaws.com/penale/a_child_called_it_download.pdfIn PDF document text
    • https://s3.amazonaws.com/wixanarer/40921114041.pdfIn PDF document text
    • https://s3.amazonaws.com/zurovajij/oxford_dictionary_english_to_bangla_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d615.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD615 1528 bytes
SHA-256: 2d84ae0636942eb5063defe9e2f34a76032a15a437a22af272f09e81a5429577
font_01_sfnt_off0000dddc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDDC 5332 bytes
SHA-256: aef6e0ef1e3f04f33fe7438d312418f0f812ba20503c3117bc7666972fa4d68a
font_02_sfnt_off0000efc8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFC8 2084 bytes
SHA-256: 03f387c6f01124d20b575d45335e42afb5621341c1b5bbf886620e6b8ca6acd0
font_03_sfnt_off0000f8d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8D7 10844 bytes
SHA-256: 2053127a76949aca521c2e8eef7d012d687f62ff958335bf1dde1383a8a0fffa

Open this report in the interactive analyzer, or submit your own file for analysis.