Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b3c8bd587b3fe17…

MALICIOUS

PDF

62.7 KB Created: 2020-12-23 11:02:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: bda6b37c944415ebf1bd14a3a07a6fbd SHA-1: 90c99fd4f0426cf42063bec77f5bd015e222f0ba SHA-256: 5b3c8bd587b3fe1758f6b064e6c8300dddfa6a6c39d5f798f218c825c7368de2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, many of which are likely part of a link farm for SEO manipulation. One prominent link directs to 'traffine.ru', suggesting a potential attempt to drive traffic or phishing. While no scripts were extracted, the heuristic firings indicate a malicious intent to distribute external links, possibly as a lure or for malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=lyrics+for+dont+stop+beliving PDF link annotation
    • https://worowisirokisid.weebly.com/uploads/1/3/4/8/134856274/1382695.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcee35ef3361272aea93aa/1606217270123/popular_french_songs_on_tiktok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c443628-63b2-4f97-a6c1-47b32cd61ecb/33074336467.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e4d01fc-3533-4cdd-9c1f-601a3c2331df/audiobahn_12_subs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2733969f-743a-4362-bb4d-143fc424bd53/sunad.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/239abed9-f763-4fd0-80c5-b3f3916a9cc2/fonunedet.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1511bbda9c57a97c10f7b/t/5fc7a54f2ac13f1ee9c1f428/1606919503948/3d_car_driving_games_in_the_city_unblocked.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17078415-87c1-4b3c-a0fd-139ea49ffe16/nissan_xterra_accessories_2001.pdfIn PDF document text
    • https://s3.amazonaws.com/sasufufa/zujukawikiremisidukufavuf.pdfIn PDF document text
    • https://s3.amazonaws.com/bubeto/ravindra_raj_name_ringtone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e58d508-eee9-466d-bb5c-6707bd802359/nodovomemubadivok.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2d1048139af037651a389/t/5fc6f831b7521d608a397835/1606875185483/horror_noises_mp3_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b9d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB9D4 5356 bytes
SHA-256: f27aeda458fffc9974c2e3db2114fec85f8629c975660e882c6cc558a80be52d
font_01_sfnt_off0000cc2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC2C 9756 bytes
SHA-256: 1977bdbe22b9ed34434c8c4753c8060dff4d5860679f86c2ac7398cdbc9d10e2

Open this report in the interactive analyzer, or submit your own file for analysis.