Malicious PDF — malware analysis report

Static analysis result for SHA-256 7aecad69b755098e…

MALICIOUS

PDF

81.7 KB Created: 2021-01-01 20:20:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 546df461601d362b4918578bac58d2f2 SHA-1: e8fbcf4a15d1fcde864034ad3f49d339ab9b5bfc SHA-256: 7aecad69b755098e7500854345791be23e3c7d9ed042ab20caa3a368c539c3ad
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains a large number of external links, with one prominent URL pointing to 'trafffi.ru', suggesting a phishing or malware distribution attempt. The presence of embedded URLs and the nature of the heuristics indicate an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=art+ball+3d+apk
    • https://namoxatiki.weebly.com/uploads/1/3/4/4/134477177/b70b26416.pdf
    • https://widosutolitidaf.weebly.com/uploads/1/3/4/8/134847614/guxenukani_zisarekez_lawum.pdf
    • https://kiseridebajesa.weebly.com/uploads/1/3/1/4/131408791/1813485.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/rupatojuko/mobdro_apk_premium.pdf
    • https://uploads.strikinglycdn.com/files/2cf9ac71-32ff-49ad-b507-95f600051335/75695983592.pdf
    • https://uploads.strikinglycdn.com/files/78bec781-3e87-4d8e-af67-0b091a0e9b97/94250102377.pdf
    • https://uploads.strikinglycdn.com/files/d62cf028-b4cf-483e-ba14-7a2b80ccc08e/rolusemunakuga.pdf
    • https://uploads.strikinglycdn.com/files/295c5c02-8654-4318-9c37-7c8966dddebd/realidades_3_capitulo_3_workbook_ans.pdf
    • https://uploads.strikinglycdn.com/files/b1fc29e9-4078-4035-89e5-ded8ac3e18a6/79705161036.pdf
    • https://uploads.strikinglycdn.com/files/b1a5fa88-fe6e-48c9-88a5-e1b6c2b3467d/modern_literary_theory.pdf
    • https://uploads.strikinglycdn.com/files/9788bf32-b6cd-40d5-8e5d-20d39ef36c07/desktop_metal_materials.pdf
    • https://uploads.strikinglycdn.com/files/5f6d26bc-0b08-42a3-a27c-de1add8e6a1e/wowuzovojog.pdf
    • https://uploads.strikinglycdn.com/files/9d821982-3a01-4d5b-a431-984f51e4a0c5/nejewa.pdf
    • https://uploads.strikinglycdn.com/files/6351a7ce-8cb1-416f-974d-fbc26af34db1/bufawepoxomodi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c03b.bin
127b44c9f93874c96d25eb7ddc4688780d8877ce931cf296363fb5748d8d514b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC03B 6744 bytes
font_01_sfnt_off0000d0f1.bin
da9227d803687063f66cf7dfa78de1ee905a540eef857ffc4d92688b8418ee34		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD0F1 3136 bytes
font_02_sfnt_off0000dc1d.bin
bc6fea5cfd177ef738d52ab0f87d289c01cba4434206f903c7bdc97bd978a3b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC1D 5132 bytes
font_03_sfnt_off0000ed93.bin
318c6efd0281b4fd07366bc4ec553e1aad371627c55b2dad3eb0c870bd52c3aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED93 5188 bytes
font_04_sfnt_off0000ffd2.bin
fb3d3588bd99ddb87f226b96227391397e32f99e19ba9b115e5bc1667fe38e71		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFD2 9960 bytes
font_05_sfnt_off00012234.bin
283938aabcbb0a8bcc0b31f98eed73ebfbaa3429185724418ddd4cd2ea838f29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12234 16480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.