Malicious PDF — malware analysis report

Static analysis result for SHA-256 61b75067a8500199…

MALICIOUS

PDF

83.3 KB Created: 2020-11-17 15:53:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 9f5c398233008cb8f13ab3c3f16d03bd SHA-1: 52ccd78fd8051781ea35c6d522764f0b296325f4 SHA-256: 61b75067a8500199ef7fd21e713a2e3313f9708e464b248f09412c6faac7d8c1
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with a critical heuristic firing indicating it links to known malicious redirector infrastructure. The ML classifier and ClamAV detection strongly support a malicious classification. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to lure users to external sites, likely for phishing or to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=itextsharp+pdf+to+html In PDF document text
    • https://cdn-cms.f-static.net/uploads/4375700/normal_5f9b814650e56.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374976/normal_5f8dc9ebdea48.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370054/normal_5fa7d4e65a7bc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410459/normal_5fa06a869ffcf.pdfIn PDF document text
    • https://medizagokitoni.weebly.com/uploads/1/3/2/3/132303310/6131267.pdfIn PDF document text
    • https://vafuzetok.weebly.com/uploads/1/3/2/7/132740798/raguxigonax_kojak_zufinawejo_joxav.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab8ab432-4764-4fc2-ae6a-3c075305b07c/josikevawuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bed65ce8-8937-4fb2-9b66-8ae597191188/68726859314.pdfIn PDF document text
    • https://s3.amazonaws.com/timafatafej/holmes_tower_fan_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/panalipolifod/17035503162.pdfIn PDF document text
    • https://s3.amazonaws.com/tumasun/xetuweguzajemori.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0001152b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1152B 25148 bytes
SHA-256: 51ea723bd1334f62cd3a83e40fe6d3760cba20c8842f834d08a4c6830ba11394
font_00_sfnt_off0000de99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE99 5288 bytes
SHA-256: c6a11ee6aa33e69a9faaa40f5dc9fc3563ee3b008f13c52e910ae9fe2578f7ca
font_01_sfnt_off0000f073.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF073 10736 bytes
SHA-256: 6e5a1125785a19bc6e61e5adf9295f97283111b48c8a9219401955a155f80c57

Open this report in the interactive analyzer, or submit your own file for analysis.