Malicious PDF — malware analysis report

Static analysis result for SHA-256 8278d4b1cc83152d…

MALICIOUS

PDF

79.8 KB Created: 2020-12-28 08:43:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: d509f6579a876b3149ba3cb423523907 SHA-1: 9b723734e88c9c696731d544ac00dcf307aae173 SHA-256: 8278d4b1cc83152d7e0f47cbb2061fe22bdac026d863c584ea8e37901ba939b1
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded links, a common tactic for phishing or SEO abuse. The heuristic PDF_SEO_LINK_FARM specifically flags this behavior, indicating a large number of external links. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or distributing further malware. While no scripts were directly extracted, the PDF structure and embedded links point towards an attempt to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?utm_term=confluence+api+template PDF link annotation
    • https://kifobanirijo.weebly.com/uploads/1/3/4/5/134595275/d0c1561.pdfIn PDF document text
    • https://kavanezeso.weebly.com/uploads/1/3/4/4/134477356/8b31a4d9d2b7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0ef0c12-20ef-4a25-bf4d-6e5e0a3a96ed/gudozazamesizoros.pdfIn PDF document text
    • https://s3.amazonaws.com/kuxuxemu/simavipixobijepugon.pdfIn PDF document text
    • https://s3.amazonaws.com/gupawupigawono/15934560030.pdfIn PDF document text
    • https://s3.amazonaws.com/desenaz/converse_plataforma_negras_altas_falsas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb1d5944-7497-42e1-ad07-79f05c1d8a97/14125472265.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11c0c61d-559b-4ebe-810e-f68b599fa290/derecho_internacional_publico_lorett.pdfIn PDF document text
    • https://s3.amazonaws.com/sikuva/41764786544.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f8487519-8502-427e-bf99-77610f57d897/giro_air_attack_shield_bike_helmet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7b03214-4c29-4134-a98c-fa22a1abfb65/j_weston_walch_publisher_worksheets_answers_us_history.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8955a8cf-042b-4cc3-96c2-c0266f1b9717/fezejapusubiva.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e107.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE107 4792 bytes
SHA-256: 03bf5dc170e0a3695ec3c219b18c9f0463a1d75acde83ad42b3cf9c71e3d7c5e
font_01_sfnt_off0000f14b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF14B 11724 bytes
SHA-256: cec7434f77f697c9ef7494e554bd23e98154e5cb1218c6565ee4a8bd583efffd
font_02_sfnt_off00011962.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11962 17116 bytes
SHA-256: 143905ac11fc282c1a2f43eb98f3deee85ffcea670e908309c260b73eb2ace9e

Open this report in the interactive analyzer, or submit your own file for analysis.