Malicious PDF — malware analysis report

Static analysis result for SHA-256 74a95705e302aec1…

MALICIOUS

PDF

89.4 KB Created: 2020-11-13 23:26:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 46e9b775dd7737e3b734400caa2fe6f4 SHA-1: 121c5611735bdd573d543d90dad2dd27f4d66039 SHA-256: 74a95705e302aec17717470e9787d45b0d918e97b55f8437a841fca8a2fe32dd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to other PDF files, suggesting a link farm or SEO poisoning tactic. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and numerous external URLs suggest it's designed to redirect users to potentially malicious content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?utm_term=ff7+victory+fanfare+extended PDF link annotation
    • https://gonoloxezejuje.weebly.com/uploads/1/3/1/4/131410007/nowarewak.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401692/normal_5f9ed9b5215c4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469645/normal_5fa75a882c39c.pdfIn PDF document text
    • https://jovikuveditowe.weebly.com/uploads/1/3/0/8/130874612/xezisifirul.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/saziwijaxodav/mechanical_comprehension_test_sample.pdfIn PDF document text
    • https://s3.amazonaws.com/toguvaju/29277825050.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6932e88-3f6c-4700-a8d9-ccb12000132a/sazovabipumi.pdfIn PDF document text
    • https://s3.amazonaws.com/fibesezati/dozasapabanu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9ccf545-babf-4365-acb7-5818bc92be70/56061994803.pdfIn PDF document text
    • https://s3.amazonaws.com/vavapekadoliti/kujuged.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70abcf5c-f8c3-4f4d-9ecf-4a92185fe844/74946808731.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66400589-8e88-4345-9313-80d9e1d03e7b/2004_mini_cooper_manual_transmission_problems.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00013a1a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13A1A 18164 bytes
SHA-256: 8e6e931f9a02b946abb889d16bd0e3953463f2dcf235394d71d53531b9abe622
font_00_sfnt_off0000f2b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2B5 4420 bytes
SHA-256: a3f7d2088187e08e3709a1845a4433183f7e05fbdad82479fe76febe786d8f7d
font_01_sfnt_off00010273.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10273 5068 bytes
SHA-256: b2a08355b6d11d1bee1ab01b10bf1330c9de287c8834275416ef747d097cd125
font_02_sfnt_off000113db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113DB 11432 bytes
SHA-256: 681f9f2a4bc6a139d112af45bef8baa0fbeff679567f95e06aa04c4996488fd0

Open this report in the interactive analyzer, or submit your own file for analysis.