Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ff780a364265c74…

MALICIOUS

PDF

62.8 KB Created: 2020-12-16 23:44:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: f4d118543ca0e91b6dc02fee691ae956 SHA-1: ec18fd15f3bd1f858a12eaccd8fb781d9b451e5f SHA-256: 3ff780a364265c74cd4e4f0319e992053ddd914b3a9208f4898e8c82523381d5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains a large number of external links, many of which point to other PDFs, suggesting a link farm designed to manipulate search engine rankings or direct users to malicious content. The presence of a link to 'trafffe.ru' with a query parameter related to a popular item indicates a phishing or scam attempt. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=golden+bear+varsity+jacket+ebay PDF link annotation
    • https://bizidijekivaza.weebly.com/uploads/1/3/4/5/134502856/6063503.pdfIn PDF document text
    • https://bodonejuw.weebly.com/uploads/1/3/4/6/134686214/tupajabewer-labato-pamipu-xenuwaju.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384028/normal_5f8cb6ac6ecec.pdfIn PDF document text
    • https://digewulafi.weebly.com/uploads/1/3/4/8/134882869/6110640.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388820/normal_5fad2fa08af0b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/32987554-272b-4888-9f8b-018aad205aa1/jujesoxukudabevuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92a5593e-9877-4b02-9322-645d1612b956/zirusipobapepoku.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c94e5bd9-54a7-492a-a8c7-137e6d0d95fa/88952076170.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ceab3d40-be8d-4503-b4ba-7c78d55d8112/35698027484.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc55a941c8c7413144fa64b/t/5fc8120813f8d93bf2f52b38/1606947336465/romexubikowonisukarojaloj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3cc8a3a-77c8-4602-bfbf-b76c8cc7bed7/34332260120.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6934e116eb00e3c734cb1/t/5fcbeb59a51c5a1401b834fa/1607199578429/twitter_login_api_in_codeigniter.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2a24d085bf90c0e084acd/t/5fd190ff23f2866aa3832cfd/1607569664130/xenak.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aca3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xACA3 5192 bytes
SHA-256: 3905c563588ec8789a501750775adbd6e47709fc182a35f52d24a0c56a7a6f03
font_01_sfnt_off0000be6e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE6E 9956 bytes
SHA-256: faa2e6ca927c392c90f49b6660a34d119034d9f88229451d11b18e8d873adaec
font_02_sfnt_off0000e073.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE073 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.