Malicious PDF — malware analysis report

Static analysis result for SHA-256 68eb22416e6c5e6a…

MALICIOUS

PDF

78.1 KB Created: 2020-12-27 12:40:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 19ab9b14dc8d3809dd5b868642f3c563 SHA-1: 551308523e3f36df1e04e0ae039a88f269b4de71 SHA-256: 68eb22416e6c5e6ab9b404be78f6eab28272ba58842c8b00994054d55f9314e7
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded URLs, with one pointing to 'trafftec.ru', which is flagged as a potential malicious domain. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the document is designed to host many links on disposable hosting, suggesting a tactic to distribute malware or phish for information. While no scripts were explicitly extracted, the presence of embedded URLs and the link farm heuristic strongly suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=dictator+movie+actor+name PDF link annotation
    • https://vuxisiso.weebly.com/uploads/1/3/5/3/135321279/marire.pdfIn PDF document text
    • https://tekopazaxalar.weebly.com/uploads/1/3/4/3/134348639/togosorig-kefusabukesina-zekuterowebe.pdfIn PDF document text
    • https://gigazubexu.weebly.com/uploads/1/3/4/6/134613152/deripofa_xipuwineduwi_tomilu_molewilenopulod.pdfIn PDF document text
    • https://wefamojugibe.weebly.com/uploads/1/3/1/1/131164519/lesudegakone.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471249/normal_5fb82df26a871.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366377/normal_5f8750bfde896.pdfIn PDF document text
    • https://cdn.sqhk.co/toralapiluw/gjijWhK/gitadoruxenonat.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/66a564be-231d-4229-81aa-5d4a956da0a7/realm_defense_best_hero_3000.pdfIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/tusolebipudat.pdfIn PDF document text
    • https://s3.amazonaws.com/bexolamabad/xisiwebarupeduxobav.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f448.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF448 4792 bytes
SHA-256: a92dcb4cddeaac28567102d7a0b037ec144ba5c3448af3e3c7b627f7e3383bdb
font_01_sfnt_off0001048c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1048C 11264 bytes
SHA-256: 33fe5c371fc2fd07193a34a995c47e2331930eb07bad24f63566d88710d0ff0d

Open this report in the interactive analyzer, or submit your own file for analysis.