Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f3ea97d944b9e18…

MALICIOUS

PDF

81.2 KB Created: 2020-11-10 21:40:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 25f49945dc3b08b823979312ce6b98ba SHA-1: d5853ed6e9d0d023c3979eba089f6a50aad4e473 SHA-256: 7f3ea97d944b9e1864b560fdaec36900f983d22d12755b33ffccf59e67ef1452
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical finding for a PDF SEO link farm containing 26 external links, with the first being https://kofusozefo.weebly.com/uploads/1/3/4/5/134515267/xipizora-zokixaluguv-gugixamaz-vivuwesasu.pdf. The ML classifier and ClamAV also identified the file as malicious. The embedded URL https://trafftec.ru/123?keyword=does+stop+and+shop+do+wedding+flowers further supports a phishing or malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?keyword=does+stop+and+shop+do+wedding+flowers
    • https://kofusozefo.weebly.com/uploads/1/3/4/5/134515267/xipizora-zokixaluguv-gugixamaz-vivuwesasu.pdf
    • https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/bupemigimamuvap.pdf
    • https://cdn-cms.f-static.net/uploads/4375352/normal_5f8f9b8619dca.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/fazujo/sbcglobal_email_server_settings_for_android.pdf
    • https://s3.amazonaws.com/vidadaviwal/macroeconomic_equilibrium_occurs_when.pdf
    • https://s3.amazonaws.com/bojafazes/23186850101.pdf
    • https://uploads.strikinglycdn.com/files/ebdedf63-dc67-40b2-b54c-8ee3582323f4/x_band_frequency_ghz.pdf
    • https://s3.amazonaws.com/zalomi/kafepegepi.pdf
    • https://uploads.strikinglycdn.com/files/6a37d78c-c50f-45b9-928e-0527ee8ab79d/55708497670.pdf
    • https://uploads.strikinglycdn.com/files/33c1163b-b415-4dae-a6ca-77f20c5872f3/amish_cheese_store_clare_mi.pdf
    • https://uploads.strikinglycdn.com/files/b1ca92e0-24ac-4f76-bc63-b224974020a0/jabenimegiduvusijikadona.pdf
    • https://s3.amazonaws.com/jagux/wilhelm_reich_books.pdf
    • https://s3.amazonaws.com/wesezuzuvalirik/lomejipaxodofetuxuwituj.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d15e.bin
37e23b4c774f9b0beb876639897c0819339a261e6e5b2eab9b57ebf32bef8cd4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD15E 5184 bytes
font_01_sfnt_off0000e2fe.bin
1cd3fd562eaa5a26a2b7bfd95163ee08c4a5a720d66ade1e52a7ea542d173162		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2FE 2528 bytes
font_02_sfnt_off0000ee02.bin
b7fe20b7937fb7c946dc9e46ad91cd750f95f7ad30199b43e4a589f16665ffbf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE02 10832 bytes
font_03_sfnt_off000112f8.bin
a17f3d3ba20c98d0f728be9cc098c72f64543aeeee8941987904bb2be0abbe8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112F8 16492 bytes
font_04_sfnt_off0001291c.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1291C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.