Malicious PDF — malware analysis report

Static analysis result for SHA-256 80c47176e52cf8a9…

MALICIOUS

PDF

75.3 KB Created: 2020-11-22 03:21:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 977a6980d4eea7d30dca6302e4af4b73 SHA-1: 1b44ad32dca4d84330d5f9744899699455af0de9 SHA-256: 80c47176e52cf8a9253cc43f0d16c6e0e812636c9a515ddca2bdbe54c9eb2647
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, appears to reference 'Steam mops at walmart', likely a lure to entice clicks on the malicious URL. The presence of numerous external PDF links suggests a link farm or redirection strategy to obscure the final malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=steam+mops+at+walmart In PDF document text
    • https://tevuvusit.weebly.com/uploads/1/3/4/3/134373155/2c45b76d00ae5f.pdfIn PDF document text
    • https://latowinu.weebly.com/uploads/1/3/4/5/134508675/wonuzu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381971/normal_5f92cae8c2037.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/69be2402-6e53-4e42-ba25-720fd10c407d/36940662026.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52215eb0-8959-4bca-855d-659c5aa6b2bf/98844323136.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/749fe83b-2f9e-40b7-898e-1192a249cf82/15276545771.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/642eac38-43a6-49bf-b3eb-0f2c71495b7d/44280451702.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2192ac19-868d-4986-962e-0e33237b71e1/75292123377.pdfIn PDF document text
    • https://s3.amazonaws.com/kokesatodixon/71670865153.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95c5eee2-0f50-4044-b527-9fe9e3412ae9/12729048017.pdfIn PDF document text
    • https://s3.amazonaws.com/fosalizuzu/a_whole_new_world_flute_sheet_music.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd64.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD64 4792 bytes
SHA-256: 7b56fb2c1924f657f1f1f968facafcda5334734bb40c9ea1030232982a4cccb9
font_01_sfnt_off0000edb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDB8 10904 bytes
SHA-256: 66c7a1b779009b9f8f84ca7379f13ced0a846c69324d9d1e7a544ba2250f595f
font_02_sfnt_off000112bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112BB 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.