Malicious PDF — malware analysis report

Static analysis result for SHA-256 4df44aa921258ded…

MALICIOUS

PDF

62.9 KB Created: 2020-11-18 23:32:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0d77c5b783c1d156bca3fac8a8331248 SHA-1: ade57b5890905c9aa0237e49e8ca0b1971d386b6 SHA-256: 4df44aa921258ded6a3bdbf476a22965257a5ddc8672b302461a4eda44ef1bf2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or redirection scheme. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and numerous external links are indicative of techniques used to deliver second-stage payloads or redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8444

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=ng+book+pdf+free+download
    • https://fopimakalegej.weebly.com/uploads/1/3/0/7/130738542/81066a.pdf
    • https://misutinulil.weebly.com/uploads/1/3/1/4/131407711/5323f949a7e.pdf
    • https://dopikilazobowu.weebly.com/uploads/1/3/4/4/134488506/4630885.pdf
    • https://sisodiwitamusoz.weebly.com/uploads/1/3/2/6/132681746/poritir_zebon_xowefon_xejago.pdf
    • https://webuxeneme.weebly.com/uploads/1/3/4/3/134368634/1923642.pdf
    • https://jubunukaf.weebly.com/uploads/1/3/1/4/131483214/jidososagesusud-modaxaso.pdf
    • https://vopipogumibuwel.weebly.com/uploads/1/3/1/4/131453394/9867847.pdf
    • https://livaganomin.weebly.com/uploads/1/3/4/3/134399079/kutimalikovazo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f60eeb11-8264-4510-9293-e930b78910ef/will_smith_bel_air_song_lyrics.pdf
    • https://uploads.strikinglycdn.com/files/5bde3da4-ee5a-4db3-b154-841f872dcc5b/gefivuvaluv.pdf
    • https://uploads.strikinglycdn.com/files/242b9233-4349-4265-b46a-838b889b58a2/72142444904.pdf
    • https://uploads.strikinglycdn.com/files/a207ab86-9e0d-453c-a700-18418db2239d/74834110144.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ca44.bin
990efa3dc3f36a326fe217b581861c01304b2531ee615e2d789be3e57fa1f402		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCA44 5296 bytes
font_01_sfnt_off0000dc74.bin
e0a04362ba1d39b4ba236d0307cb735bbdca01a0ac89b78135df8e18bbf720a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC74 10720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.