Malicious PDF — malware analysis report

Static analysis result for SHA-256 634a96d21cda6bed…

MALICIOUS

PDF

57.7 KB Created: 2020-11-06 22:41:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 7b2ddfa002cd7aef005ee5af89261878 SHA-1: 1ce5f50388e331f2c2191bde76484591e6fda735 SHA-256: 634a96d21cda6bedeceff4be4c7d03844b767c94336a640939320c8d409e5428
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-optimized, suggesting a link farm or SEO manipulation attempt. The 'SE_CALLBACK_LURE' heuristic indicates a potential callback phishing or tech-support scam pattern, although the document body itself is heavily obfuscated and appears to contain embedded URLs. No scripts were extracted from this sample, but the presence of numerous external links and the ML classifier's high confidence score point towards malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?keyword=brainpop+ph+scale+worksheet+answer+key PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4469103/normal_5fa4e4f575d38.pdfIn PDF document text
    • https://mumixopid.weebly.com/uploads/1/3/1/8/131872042/c68478389b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387932/normal_5f9c17da97cfe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409395/normal_5f93f832b2065.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368225/normal_5f8ef241233be.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365562/normal_5f87315ce5614.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bejenosugede/christmas_plays_in_washington_dc_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/tezofuretejom/nonusa.pdfIn PDF document text
    • https://s3.amazonaws.com/zunaduxa/73645634649.pdfIn PDF document text
    • https://s3.amazonaws.com/vabemavuputenif/az_screen_recorder_premium_mod_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e9d5a91-5284-4547-aabb-cfa46829e9ab/fodikeripubararevi.pdfIn PDF document text
    • https://s3.amazonaws.com/rimepusox/wazinekidev.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000892e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x892E 5328 bytes
SHA-256: d0f0c07215b5e7ad2bb140196795db0a6c81310c1bad229eced1c249e0bb31eb
font_01_sfnt_off00009b5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9B5D 11716 bytes
SHA-256: 89928747de58c697ae113245ce9936cd15b87f40c34106e69939f29ba92ae3e2
font_02_sfnt_off0000c2d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2D4 16140 bytes
SHA-256: 00468df452218f546d59995a7cf9b4297092e2fd476dbd2f6ce79846bd051107

Open this report in the interactive analyzer, or submit your own file for analysis.