Malicious PDF — malware analysis report

Static analysis result for SHA-256 3779fb0c15dcb081…

MALICIOUS

PDF

80.8 KB Created: 2020-12-20 08:33:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 89344d3ad9a5416252f11f94dfdc221a SHA-1: 5871e9d73b5496f2138d4422c7efe69f99b889f5 SHA-256: 3779fb0c15dcb0812e15ac632417d15c7b9ebca01f7ae68c089ffc2681f8986e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. The document body, though heavily obfuscated, suggests a lure related to a "Westinghouse timer manual". The presence of a large number of external links, including one to "traffking.ru", strongly suggests a link farm or redirection mechanism, likely intended to lead users to malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=westinghouse+timer+manual+28011
    • https://negotibuveno.weebly.com/uploads/1/3/4/7/134733978/jarurobejesonuki.pdf
    • https://zixatemanareku.weebly.com/uploads/1/3/4/4/134472678/6284620.pdf
    • https://mosuzikovadapa.weebly.com/uploads/1/3/4/6/134667275/1283285.pdf
    • https://tamalokumolegi.weebly.com/uploads/1/3/4/6/134656593/9e856.pdf
    • https://firedisivimi.weebly.com/uploads/1/3/0/9/130969818/fa03d8615.pdf
    • https://nokaxogu.weebly.com/uploads/1/3/4/5/134520383/1ffe23f24282.pdf
    • https://bokixewabukogu.weebly.com/uploads/1/3/4/3/134341992/fosazibusidut_gikefurovek_wovesetegudeti.pdf
    • https://medizagokitoni.weebly.com/uploads/1/3/2/3/132303310/gizixulu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.orgThis
    • http://www.daltonmaag.com/
    • https://static1.squarespace.com/static/5fc112aed26ff1194f74a888/t/5fc1c7ba9d79364840cfb1d5/1606535099720/fasovuj.pdf
    • https://static1.squarespace.com/static/5fbfd016c30a162e0c4c3cab/t/5fc34ffe7acac6192a2a91f3/1606635518914/89903607590.pdf
    • https://static1.squarespace.com/static/5fc11101d26ff1194f749d44/t/5fc5e62c3c6ccf69f32b2eae/1606805039633/sofefu.pdf
    • https://static1.squarespace.com/static/5fc7185a5fa98a681f0c9b59/t/5fcdadec2fa8bc6bcd06e6c1/1607314924539/kajuwowo.pdf
    • https://static1.squarespace.com/static/5fc002d40b6b03258f30bf3d/t/5fc21243e18c5c478e433cd3/1606554180334/dmv_jackson_ms_id.pdf
    • https://static1.squarespace.com/static/5fc578abd49dd1244753261b/t/5fc9cdda9309303fb831e0c3/1607060955221/34995913850.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://scripts.sil.org/
    • http://scripts.sil.org/OFLAbyssinica

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000be8e.bin
bc3a3327c6b0eeba430b64de11308b59aa3d782ba8dec0d015bfdef8a7d7a702		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBE8E 5516 bytes
font_01_sfnt_off0000d120.bin
8f3c6ac098290535930a62471c59cc01db724254982e8b22b5293056f919eaaa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD120 20800 bytes
font_02_sfnt_off0000f0c5.bin
27af942ab1e570af72be485ed70e2db2e63c2e3ff550e9df1811ae7dabc494a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0C5 4856 bytes
font_03_sfnt_off00010324.bin
60831dc78d277daedccd4597520e96e409fa4038427a016645d09080912699e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10324 10568 bytes
font_04_sfnt_off0001273f.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1273F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.