Malicious PDF — malware analysis report

Static analysis result for SHA-256 34153ddebcb91be9…

MALICIOUS

PDF

77.6 KB Created: 2021-01-15 19:34:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5ff83afca4304988bae3e645ef9e4039 SHA-1: 703cd72ec82f26ae8cf388b360c145fb5f6ba1b6 SHA-256: 34153ddebcb91be94be7e1a7834ab985b8760d563d52b29dc399827e17eb201b
254 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains multiple links to external resources, including a known malicious redirector and a link farm, indicating a phishing or malware distribution attempt. The heuristic 'SE_BROWSER_INSTALL_LURE' strongly suggests the document's purpose is to trick the user into installing malicious software by posing as a necessary browser update or extension. While no scripts were directly extracted, the presence of embedded URLs and the ML classification point towards a malicious intent, likely involving exploitation or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?utm_term=bulk+image+downloader+registration+code+free
    • https://cdn.sqhk.co/jedelamodafa/jh8hiRq/11021699716.pdf
    • https://cdn.sqhk.co/luvutagawata/3m5mqnx/3978841846.pdf
    • https://cdn.sqhk.co/govizanorev/ghghjaK/read_along_the_lines_meaning.pdf
    • https://cdn.sqhk.co/jizesusaxeta/cAZMohc/granny_legend_hero_mode_level_9.pdf
    • https://majijajivetik.weebly.com/uploads/1/3/4/2/134265766/26390f85279b33f.pdf
    • https://site-1173990.mozfiles.com/files/1173990/22336736593.pdf
    • https://site-1238560.mozfiles.com/files/1238560/cisco_webex_kit_installation_guide.pdf
    • https://site-1244605.mozfiles.com/files/1244605/fixuxifeli.pdf
    • https://jiluzeros.weebly.com/uploads/1/3/4/3/134365673/434897.pdf
    • https://site-1168066.mozfiles.com/files/1168066/koat_tv_7_breaking_news.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jikopot/petowawufi.pdf
    • https://s3.amazonaws.com/tabobujimo/58427108571.pdf
    • https://s3.amazonaws.com/fifomi/9286876391.pdf
    • https://s3.amazonaws.com/divexikav/excel_vba_clear_all_cells_on_sheet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f077.bin
dbdd83c626358a0d1befc9719d4ca37548cc4f7cbbe6d388af5172c085ccf4ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF077 5544 bytes
font_01_sfnt_off00010350.bin
eed2d3ea8639139c5dce85f0fce5f407c034bfbefc0104abe1822a0a09d5bb11		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10350 11040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.