Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b9ecfa84233773f…

MALICIOUS

PDF

66.6 KB Created: 2020-11-20 05:55:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a4068c9a3ac3a7f55888164a8198b1a9 SHA-1: 1b4ffa3e7031e35bdcc2f168a37b53136103af5f SHA-256: 5b9ecfa84233773f26798f29bd9df2418f4f6144875f985c249c6800f3ca66c1
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical finding for a mass external PDF link farm, and a ML classifier indicating maliciousness. The presence of numerous external links, including one pointing to 'javakagepomo.pdf', suggests an attempt to redirect users to malicious content. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, indicating it was likely generated programmatically.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=longest+snapchat+streak+2020
    • https://xogexemufak.weebly.com/uploads/1/3/1/4/131437987/javakagepomo.pdf
    • https://cdn-cms.f-static.net/uploads/4367313/normal_5f8f38362be32.pdf
    • https://cdn-cms.f-static.net/uploads/4409113/normal_5f989c206e966.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/76d4b543-66eb-48d4-bf16-835d63861dea/74312370259.pdf
    • https://s3.amazonaws.com/nerugiraxura/understanding_definition_synonym.pdf
    • https://s3.amazonaws.com/zikeko/86249418029.pdf
    • https://uploads.strikinglycdn.com/files/b399b0ba-18e7-453c-9e9a-1655873f0585/tuvovelikinuxa.pdf
    • https://s3.amazonaws.com/kozibowisenatu/77335333044.pdf
    • https://uploads.strikinglycdn.com/files/78e92af6-ae76-4df2-b4fd-81371ae3675f/buzanatimog.pdf
    • https://uploads.strikinglycdn.com/files/6c795b83-b637-405c-8331-6f5862d58672/welinivosepe.pdf
    • https://s3.amazonaws.com/zaxuledo/mastering_the_mix_reference_manual.pdf
    • https://uploads.strikinglycdn.com/files/c0001698-4da0-428f-a3e7-9323e25c0b6b/zazibunujorukopijisilas.pdf
    • https://uploads.strikinglycdn.com/files/72e18611-972a-405c-acd7-9b1e47b5e4b8/6040880567.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c7da.bin
91b830d8d13deaf173b24f3da8a5ae2130b8d7c2a82dd44ccbd46187d93fdba2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC7DA 5444 bytes
font_01_sfnt_off0000da63.bin
e47b6e30ea529fcdc3911a83dc6d75cbbfbd1d84ad190beb0a5bf8a81f4d8817		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA63 10400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.