Malicious PDF — malware analysis report

Static analysis result for SHA-256 55df8c51a3320c74…

MALICIOUS

PDF

74.1 KB Created: 2020-12-27 18:10:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 60c454d05f06f195a73ac43eb79bdcd3 SHA-1: 150f173d26fbcbb9c6f23f5dbcd46b67332db021 SHA-256: 55df8c51a3320c7449337d69cf4e37daa0ec3a63518fda7147862e60090e24ba
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, including a link farm detected by heuristics, suggesting a phishing or SEO spam campaign. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were extracted, the presence of embedded URLs and the 'Urgency / deadline lure' heuristic point towards a social engineering attack, likely a phishing attempt to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?utm_term=home+depot+plant+return+policy+canada
    • https://tejiwubatimi.weebly.com/uploads/1/3/4/8/134899102/8930973.pdf
    • https://wekonopu.weebly.com/uploads/1/3/4/8/134848362/nisurawadeto-toxun-jemugo.pdf
    • https://virubavu.weebly.com/uploads/1/3/4/7/134755547/6719023.pdf
    • https://mapipuluzobeb.weebly.com/uploads/1/3/1/3/131398440/1763158.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2c567989-cdd3-41d8-bfd4-efde6fafea02/home_for_little_wanderers_thrift_shop.pdf
    • https://uploads.strikinglycdn.com/files/f0706048-8bac-4264-99a7-0879742aee36/fortune_cookie_maker_kit.pdf
    • https://uploads.strikinglycdn.com/files/e3bb01e8-4284-4dd5-b48b-fe549a99ad68/how_to_git_gud_at_dark_souls_3_pvp.pdf
    • https://uploads.strikinglycdn.com/files/14b9f455-cdb3-4159-8b65-7c9a9e5d562b/mhendislik_etii_ders_notlar.pdf
    • https://uploads.strikinglycdn.com/files/109072e2-cc18-4d1d-ad2b-528608ab7692/73654966805.pdf
    • https://uploads.strikinglycdn.com/files/7570ecd4-69ec-4037-b0cf-0193369f3509/mazotokijugipolemokupavo.pdf
    • https://uploads.strikinglycdn.com/files/d0da9a29-6ece-4b37-85bd-7b53c70f6c60/94973207103.pdf
    • https://uploads.strikinglycdn.com/files/982e245c-8836-4da1-bd6a-953bb8b74cba/58600609517.pdf
    • https://uploads.strikinglycdn.com/files/0b19270a-3b8b-4bb3-ad24-fcec5d061a21/baby_bearded_dragon_not_eating.pdf
    • https://uploads.strikinglycdn.com/files/28c57503-b6e2-4630-a20c-57a6b52b2055/wazufoni.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e43a.bin
ca4dfda22f82e3fd8d99c54ecafc50b8c12a262ae331b44dec0f574b91446f89		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE43A 5104 bytes
font_01_sfnt_off0000f584.bin
69c5083152fc984b321f064d47e02fa4f7cbe100f5c9107ab661dfa5eb9ac2dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF584 11436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.