Malicious PDF — malware analysis report

Static analysis result for SHA-256 71992a761e5654a8…

MALICIOUS

PDF

60.3 KB Created: 2020-12-16 03:37:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5ad4106383d8bc193470b53ec117bad2 SHA-1: b428ca78dfc91fc2c69fb34f50bd943446f6c09d SHA-256: 71992a761e5654a82b06e3742912f952d9a3289c58472d17675e7124eb7e25ee
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded links, with a critical heuristic identifying it as a "PDF_SEO_LINK_FARM" containing mass external links. One of these links, "https://trafftec.ru/aws?utm_term=finite+mathematics+12th+edition+answers", is flagged as suspicious and likely leads to a phishing or scam page. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a "Pdf.Phishing.Trojan". Although no scripts were explicitly extracted, the nature of the PDF and its embedded links suggest it is designed to redirect users to malicious content, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?utm_term=finite+mathematics+12th+edition+answers
    • https://dokakuzod.weebly.com/uploads/1/3/4/8/134884054/9449990.pdf
    • https://jokepalebaja.weebly.com/uploads/1/3/4/3/134360350/pezazulepodo-xonutur-kijejajigema-vawujadesojaxid.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/539d2c8c-53ab-41e4-b8ce-7d46bbb9c8e6/tatudepagomevexuv.pdf
    • https://uploads.strikinglycdn.com/files/8cdc4605-8dba-4356-b249-6974c24ff9dc/jogaxew.pdf
    • https://static1.squarespace.com/static/5fc0f252e5c7695ca99bde90/t/5fd1d274b91f50015eee9ca8/1607586421390/89933657952.pdf
    • https://uploads.strikinglycdn.com/files/5d8652c4-f167-46c7-9666-4b911710a668/mens_health_yahoo_answers.pdf
    • https://s3.amazonaws.com/novipaliwid/formal_dress_meaning_in_urdu.pdf
    • https://uploads.strikinglycdn.com/files/5df4c0f8-4726-4b75-b475-5e47de813bf3/52784306574.pdf
    • https://s3.amazonaws.com/safago/ost_chuunibyou_take_on_me.pdf
    • https://s3.amazonaws.com/wilugugo/52732915967.pdf
    • https://s3.amazonaws.com/rakabexozu/42924527197.pdf
    • https://s3.amazonaws.com/subud/73306380185.pdf
    • https://uploads.strikinglycdn.com/files/391db376-eeb4-43b9-81cb-061f312e2b23/92605235031.pdf
    • https://uploads.strikinglycdn.com/files/838557df-3712-4da6-8784-e3c50218082d/kuzolebanowefabejep.pdf
    • https://s3.amazonaws.com/potofaw/exercices_corrigs_sur_les_amplificateurs_oprationnels.pdf
    • https://s3.amazonaws.com/gajakelegeza/satta_king_gali_disawar_ghaziabad_ki_report.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aedf.bin
8d2ad59e1e52618d490a7a969fc0ab2fabee5ba55cf5ff6ad49b8d63f7fb9344		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAEDF 5380 bytes
font_01_sfnt_off0000c114.bin
ae923b1615c0a8fdeb9691a567d2b8dc0bfc1ad78850a6b31d60116fadfd098d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC114 10300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.