Malicious PDF — malware analysis report

Static analysis result for SHA-256 4984db5aac75e885…

MALICIOUS

PDF

74.0 KB Created: 2020-12-21 21:17:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: dd7775156191610460cc3c1e5c3ac473 SHA-1: 84cfb4ca9c1f0b1ab4dc98ee699b5b4194180231 SHA-256: 4984db5aac75e885b9187830e0e2972021a1e92c04280a39626e7bc54a24e99f
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for link farms or phishing campaigns. The ClamAV detection and ML classifier strongly indicate malicious intent. The primary URL, traffnew.ru, is likely used to redirect the user to a malicious site, potentially for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=egg+noodle+dishes+recipes PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4384480/normal_5fa30e1111249.pdfIn PDF document text
    • https://fidurelofomus.weebly.com/uploads/1/3/0/7/130740547/kadilibira.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426974/normal_5fc93035b2b31.pdfIn PDF document text
    • https://visumosibe.weebly.com/uploads/1/3/0/8/130814065/2019104.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408461/normal_5fbddb471ef8e.pdfIn PDF document text
    • https://zekilunadaxidub.weebly.com/uploads/1/3/4/6/134631079/225d220727.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497369/normal_5fb526e767c03.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fce09b11d9e1221b038c380/t/5fd6384bab1a676c728878e0/1607874637326/wells_fargo_wire_transfer_form.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc77d6af59f035d0ccd659c/t/5fcb01a9b495bd2028199e21/1607139762293/fijosijevomoxu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e3a633b-a384-4c01-9d59-81b93e1f7f61/las_partes_del_cuerpo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e85027a199023ab5619d/t/5fca27bd9c93c058c48d1c5f/1607083965855/56520840499.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2ccee5687f52b6b8d7e2d/t/5fd1cf8a880fa23343d513a8/1607585676313/nhl_games_live_score.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fdd546437a75c289d599510/t/5fddf3b3892c8943b09f35bf/1608381364286/scholarship_interview_tips.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc57efae5c7695ca9ba963a/t/5fcbdeda21c0486e91a16967/1607196381670/bobowarekata.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8AB 4788 bytes
SHA-256: a47a47ccab543b33770bacc7973b3cc4ae5740149a3ce454f4c959d0812d7740
font_01_sfnt_off0000e8de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8DE 10540 bytes
SHA-256: 81d3567764ec16c14c8f921ab0648b71a079e72da46aef2f2a231a4b81d0940d
font_02_sfnt_off00010ca9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CA9 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.