Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d7a69c27fb11a0f…

MALICIOUS

PDF

86.4 KB Created: 2020-11-24 20:42:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02869969f2571e6f0f517f6f8190aad5 SHA-1: 13a7941a2e16e078073ce6a7b2f7b12653a08f89 SHA-256: 6d7a69c27fb11a0fd90c151d58d89dfebc69e4c5ac572afdca94320f38d72e67
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm and an embedded URL pointing to a lure for an 'iPhone 5s screen replacement kit'. This, combined with the 'Urgency / deadline lure' heuristic, strongly suggests a phishing or malware distribution attempt. The ML classifier and ClamAV detection further support its malicious nature. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=iphone+5s+screen+replacement+kit
    • https://jamafijuzu.weebly.com/uploads/1/3/1/4/131437216/9664319.pdf
    • https://tajuzoliv.weebly.com/uploads/1/3/4/3/134359899/dukinivebaxo.pdf
    • https://vuxofuta.weebly.com/uploads/1/3/4/2/134235669/9353298.pdf
    • https://kupanonul.weebly.com/uploads/1/3/4/6/134682697/sitire-lesudis-pivaxut-julasebesivu.pdf
    • https://vezexozozufizus.weebly.com/uploads/1/3/4/3/134372857/tapidagapipu.pdf
    • https://tivakoxidedopa.weebly.com/uploads/1/3/0/7/130776298/nuxosiw_kifizedawate_ladarefun.pdf
    • https://jusujonolixutuw.weebly.com/uploads/1/3/1/3/131379247/fuwuzesobizixegatuje.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/0684606f-c838-4871-b221-ac7c22cb8f01/43895131162.pdf
    • https://uploads.strikinglycdn.com/files/2f94338d-1c42-4f67-8950-056ea7e2c4b5/vintage_craftsman_drill_press_manual.pdf
    • https://uploads.strikinglycdn.com/files/9f442a9e-4ca3-413e-a2b1-4dd8ea33ebb3/word_that_starts_with_ore.pdf
    • https://uploads.strikinglycdn.com/files/693b0030-c397-428d-a59a-bc07b54672a7/45773412403.pdf
    • https://uploads.strikinglycdn.com/files/a1800780-a3d8-4d63-a018-c9ca04116efa/google_drive_were_processing_this_vi.pdf
    • https://uploads.strikinglycdn.com/files/d06c3873-4c41-4f9d-a0da-e4a09be0a5d6/misesovizer.pdf
    • https://uploads.strikinglycdn.com/files/60826f20-f10c-4610-aaeb-281dfbfa6dfb/47539190085.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2f4.bin
2ce5a7286efefc5aae27ce1c31b3347e159d00bd30cf97f509a0b7f7d49caffb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2F4 6440 bytes
font_01_sfnt_off0000e2b8.bin
f5ffd33d819fef3bbaa14510ee4901058a8837130854b1a5958ee82851db0796		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2B8 2888 bytes
font_02_sfnt_off0000ecfd.bin
b270c8ae175069d64b5bacb0de152aecb06ca7b882f149d434d29159ab8bbe77		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECFD 5088 bytes
font_03_sfnt_off0000fe05.bin
56e68be3a24735b87f82b0bc4e6726152f3b3c83f401b4566a0fca3412e43a6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE05 11424 bytes
font_04_sfnt_off000124f6.bin
d9a48a6eb473f6830c796306bfce8993f4347b5813e90f69d1dcd7ed8515898a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x124F6 16572 bytes
font_05_sfnt_off00013b3b.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B3B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.