Malicious PDF — malware analysis report

Static analysis result for SHA-256 5482b71f8507df40…

MALICIOUS

PDF

44.1 KB Created: 2020-11-09 10:46:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: ea6020b3ab4e9fbd6aaf8181a00cc6a0 SHA-1: 737c7c09083b964e0232c83a18eaf8ca0ca5d9e0 SHA-256: 5482b71f8507df40cc28ceb422110bf1106aa109fb0c1795afff6600ed4c0c2a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The primary external URL observed is 'https://trafffi.ru/aws?keyword=keurig+b77+user+manual'. This suggests the document is part of a link farm or phishing campaign, aiming to redirect users to potentially malicious sites. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?keyword=keurig+b77+user+manual PDF link annotation
    • https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/kadupe_ripovu_jozovagazemewe.pdfIn PDF document text
    • https://folanejo.weebly.com/uploads/1/3/0/7/130776558/temolawenetivolodo.pdfIn PDF document text
    • https://dowikonusinewe.weebly.com/uploads/1/3/4/3/134374018/zifibigeluvi-sizozalix-lurajogij.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426820/normal_5fa7602982c9b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402280/normal_5fa473c38e654.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f379fe79-283a-4081-a66b-8f2f81ccdd96/crystal_reports_version_10_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27e898a0-c16e-4c6b-b5af-eb600f875f7e/sony_str_de695.pdfIn PDF document text
    • https://s3.amazonaws.com/fedure/why_a_peaceful_woman_carries_a_gun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9407bc7-391c-4319-88e5-a301cf40e47c/87356000479.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73ffabae-6617-4f26-a301-46424bbbcfbe/ponarekurufusokip.pdfIn PDF document text
    • https://s3.amazonaws.com/wapabefizosumi/chemical_and_physical_changes_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3e23116-1120-45c1-81c5-d91975905a0d/44502606258.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9a93607-832e-48cd-a2cb-fa8808e7fd2e/51_chevy_pickup_parts.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E49 5196 bytes
SHA-256: 3d1e250d0b5dddd64ea2b71a6a873a75336105846ab0749ca895104c8833b249
font_01_sfnt_off00007fea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FEA 10336 bytes
SHA-256: 55159be06ef3fce24d22a55b09b4a563d4b9efb9a372dd868ba18a857a7e7a54

Open this report in the interactive analyzer, or submit your own file for analysis.