Malicious PDF — malware analysis report

Static analysis result for SHA-256 675647bd4042418a…

MALICIOUS

PDF

72.4 KB Created: 2020-12-17 13:33:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 60c4f1589af280f68ccb8bbd1cc16190 SHA-1: 3dce07fa6b4d47663e6b8520712578a05653af9c SHA-256: 675647bd4042418aafb9499da6d346517a4342de46a0b0117885ae76c78f6a6a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to PDF files hosted on various domains, suggesting a link farm or SEO poisoning tactic. One prominent URL, 'https://trafffi.ru/strik?utm_term=memphis+campus+map', is presented as a lure. ClamAV and ML classifiers strongly indicate malicious content, specifically a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=memphis+campus+map PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4479916/normal_5fbe2a565b748.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372983/normal_5fd8e30007c67.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375515/normal_5fda8cf4decde.pdfIn PDF document text
    • https://tunomofezu.weebly.com/uploads/1/3/2/3/132303147/3451839.pdfIn PDF document text
    • https://wibugosavuzatug.weebly.com/uploads/1/3/4/3/134349607/5217818.pdfIn PDF document text
    • https://pexafibilo.weebly.com/uploads/1/3/4/4/134484824/binevimetuf.pdfIn PDF document text
    • https://fevuxutub.weebly.com/uploads/1/3/4/1/134131759/9b16d4409.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383300/normal_5fd64f5261c0c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446489/normal_5fb477196f261.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf1a3b474932ca2668019/1606218147746/german_road_signs_test_in_english.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/347ae0fe-455c-4247-9b22-49e007b2b267/xiwulerimudan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2a6a327-782c-4f5e-8169-cbc20898cf2a/lovofinetepe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7601319d-72b9-43cf-8753-9d4a8661bfa9/78045565336.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc33d14d49dd12447435ca7/t/5fcf28878b174454e9999b11/1607411849145/14441562221.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5ab97405d5340f34a42aa/t/5fc7a2f1efc65c5b7a495717/1606918897834/scion_tc_dash_light_color_change.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81515ad0-2a04-4187-be3f-e911656a2915/videpuxomamibi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33bd1bc3-ec1d-4576-8210-c50b0d75b0f2/director_of_client_services_role_description.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc794aa849d1727bc133313/t/5fcea07386f8e37a92a21694/1607377011301/94084762246.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC61 5052 bytes
SHA-256: 979e54379d74ad190f3df32190bc9aaf2b11de4ba2b8f476af82928644af177c
font_01_sfnt_off0000ed73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED73 11616 bytes
SHA-256: 312ffbcef84a73a8abc41d4d10951687983cd0dbfef50850920dc1c32aeada9e

Open this report in the interactive analyzer, or submit your own file for analysis.