Malicious PDF — malware analysis report

Static analysis result for SHA-256 7201e3e6fa05f667…

MALICIOUS

PDF

90.9 KB Created: 2020-12-16 14:00:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 0cd6a6947d4ab96756a0931d03dc615b SHA-1: 3842357e55fc1f3ad2c8d7961301999e1ef80b45 SHA-256: 7201e3e6fa05f667576a3a20c753acae4810f43752ddea9b207dc7e8482ed71f
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of external URIs and a link farm. The primary malicious URL, https://traffking.ru/aws?utm_term=emotional+intelligence+survey+questionnaire+pdf, is embedded within the document, suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and the nature of the heuristics point towards a malicious document designed to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?utm_term=emotional+intelligence+survey+questionnaire+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4366044/normal_5f890d991cc07.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415525/normal_5fab50abc60db.pdfIn PDF document text
    • https://manoxumumaxu.weebly.com/uploads/1/3/4/4/134472756/lesuzixadarelori.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf7dfc5d-ce6a-4128-be54-2636deaea4e7/belufiwarixu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0923ebc-b0c1-49c1-ada9-1f42a015a5ce/7901495627.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0b4e4c89e1c4b8fbd626a/t/5fc1117518e72e5fdbfd3613/1606488438420/geliketovefiperuso.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4f349e2fce462bca5d5b8/t/5fc7cc42a66cae0766279510/1606929475260/xanevukorino.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1446fab8-6aac-4f6b-9664-20daf24be7ea/23820456003.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aae543c1-df32-4cf9-8f48-85d913c45077/mullet_bay_beach_bar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/098362bd-98b4-430e-a903-85133fdbb966/the_iodine_crisis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9835cde3-f4b7-46d0-94ce-c6f5450ed506/strip_diagram_for_multiplication.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/361f28b3-d025-4e72-88e6-a3908b6b4041/organigrama_escalar_de_una_empresa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f63f52b3-6694-47bd-965d-d4e60e2fc6f0/70262454873.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000122da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x122DA 5720 bytes
SHA-256: 523c86e09b00da544291f64e95e696cbd296fcb79a330bf5693dd410e5248668
font_01_sfnt_off00013641.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13641 11288 bytes
SHA-256: 8d7ba8e04361e2363a6ad277b6baf2b2a1fa1f547406061a00ec5b97e7de3873

Open this report in the interactive analyzer, or submit your own file for analysis.