Malicious PDF — malware analysis report

Static analysis result for SHA-256 50ec01cf25f08373…

MALICIOUS

PDF

70.4 KB Created: 2020-12-28 12:57:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 92230963b22d794a1257b295470a23cb SHA-1: d0d1723b0b65342cc3429399a5b511dd6b95a8f6 SHA-256: 50ec01cf25f0837311fd3dc69474ab94a1cb1f41d21b3e3107fbfc254081fa49
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'PDF link farm' pointing to 26 other PDFs. The primary URL, 'https://trafffi.ru/strik?utm_term=moving+checklist+app+iphone', is flagged as unknown reputation, suggesting a potential phishing or malicious content lure. ClamAV detection as 'Pdf.Phishing.Trojan' further supports its malicious nature. While no scripts were explicitly extracted, the PDF structure and link farm indicate an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=moving+checklist+app+iphone PDF link annotation
    • https://vojumemij.weebly.com/uploads/1/3/4/4/134473557/lejikupesukadedas.pdfIn PDF document text
    • https://wisakonison.weebly.com/uploads/1/3/4/7/134766038/d3e85ea.pdfIn PDF document text
    • https://runebipunozup.weebly.com/uploads/1/3/1/4/131406604/6443372.pdfIn PDF document text
    • https://cdn.sqhk.co/juzogimuju/aHNccjg/ponimiketafusijo.pdfIn PDF document text
    • https://cdn.sqhk.co/nosuterib/ic8DyrR/mobile_strike_mini_game.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/ropuba/lubebozewifof.pdfIn PDF document text
    • https://s3.amazonaws.com/kitakilesa/grammar_based_conversation_questions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aad3a95f-19b0-4814-8726-1fd5416dd36c/torom.pdfIn PDF document text
    • https://s3.amazonaws.com/jenisozazewubo/office_2016_crack_full.pdfIn PDF document text
    • https://s3.amazonaws.com/xijuxosisomuna/fipoxop.pdfIn PDF document text
    • https://s3.amazonaws.com/febopa/gizosuginasufapizim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d8bc8d3-4000-4513-8229-b843371b88f8/92380902925.pdfIn PDF document text
    • https://s3.amazonaws.com/lokijuronig/nakoniret.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d797.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD797 5228 bytes
SHA-256: b130370437baf8c042c11f9f34baac1a7a5928e356477a86a18fb5dc123c6d63
font_01_sfnt_off0000e981.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE981 10316 bytes
SHA-256: cc7ead9ba2d4ca621f1242c83c796352a5fbea12c81f721d56d9fad875062a8a

Open this report in the interactive analyzer, or submit your own file for analysis.