Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a3b0964c2efd7be…

MALICIOUS

PDF

66.8 KB Created: 2020-11-17 07:03:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: e024c56228ace84bf17b6c2ab116ae9c SHA-1: 84cd19daed2528182676e82a0a213ea23e860254 SHA-256: 4a3b0964c2efd7beed6928b9e8508f01bcfbc76e91dc17be2de0dfa79ece27eb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple external links, with a critical heuristic identifying a 'PDF_SEO_LINK_FARM' suggesting a large number of outbound links. One prominent URL, 'https://trafftec.ru/strik?utm_term=bhigi+palko+pe+song+download', is directly embedded and appears to be a lure for a song download. The ClamAV detection and ML classifier also flag this PDF as malicious, likely due to its content and structure designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9741

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=bhigi+palko+pe+song+download PDF link annotation
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/36ce75ac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420235/normal_5fb2a30745605.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411694/normal_5f9ece0a910bb.pdfIn PDF document text
    • https:////a10.gaanacdn.comIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://s3.amazonaws.com/tetazino/66228163031.pdfIn PDF document text
    • https://s3.amazonaws.com/damevusom/epididymitis_infections_videos.pdfIn PDF document text
    • https://s3.amazonaws.com/rejiner/special_26_movie_123mkv.pdfIn PDF document text
    • https://s3.amazonaws.com/nefomojuwet/separation_payment_tax_treatment.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c662ff0-7055-4c45-a093-9453ec0f3afb/thillai_ambala_nataraja_song_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aca9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xACA9 3036 bytes
SHA-256: 356e021e7a7006eb0f33be76b92851191e680e81fdf745d3c082578eb854a5ef
font_01_sfnt_off0000b9bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB9BB 5328 bytes
SHA-256: 797ffdfd972bdd5ea0f3a1e4a0bfc9064d41d357ac939026eea3b4fb43f96d2d
font_02_sfnt_off0000cbec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCBEC 10720 bytes
SHA-256: 4d2f1fe6fab4721d117eb1df88b2d800d7f8c63a96576a47ea9834eab52b85af
font_03_sfnt_off0000f09b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF09B 3516 bytes
SHA-256: 58c2cf37e14f52cf72e06659db1d5a4421f0ee6ab101303148a002cdd465409c

Open this report in the interactive analyzer, or submit your own file for analysis.