Malicious PDF — malware analysis report

Static analysis result for SHA-256 82c4672b29bd0dfe…

MALICIOUS

PDF

70.9 KB Created: 2021-01-06 07:54:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 2ff81aa3fc4ba7f41addea218221a9c0 SHA-1: 723b1b83391e3b5bb4d74bbb51cf7986be665d01 SHA-256: 82c4672b29bd0dfe0b4b9a8f416d89cfbe5285b1f8b316e437aa1c115d7ba298
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document contains a large number of external links, with the primary suspicious URL being 'https://trafficel.ru/aws?utm_term=kathi+songs+free++starmusiq'. While no scripts were explicitly extracted, the PDF structure and the presence of numerous external links point towards a phishing or content distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=kathi+songs+free++starmusiq PDF link annotation
    • https://cdn.sqhk.co/lexewagoz/Mfjiwig/sukuzejadif.pdfIn PDF document text
    • https://fopabavegovos.weebly.com/uploads/1/3/4/7/134744375/5110785.pdfIn PDF document text
    • https://pidadilux.weebly.com/uploads/1/3/4/6/134666204/gezumuwavizegekis.pdfIn PDF document text
    • https://woxevodojagub.weebly.com/uploads/1/3/4/6/134623787/64eae59239b4baf.pdfIn PDF document text
    • https://zebaraxofalolal.weebly.com/uploads/1/3/0/8/130813897/1688067.pdfIn PDF document text
    • https://xipidutaz.weebly.com/uploads/1/3/4/4/134401361/jotemegedunegulol.pdfIn PDF document text
    • https://cdn.sqhk.co/bikezuku/igigijc/lugorozajuworu.pdfIn PDF document text
    • https://kitedagipan.weebly.com/uploads/1/3/4/8/134892955/edaeb08b97ecc10.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zijivevip/kedadinuzigu.pdfIn PDF document text
    • https://s3.amazonaws.com/woberiz/cambridge_university_press_english_for_business_communication.pdfIn PDF document text
    • https://s3.amazonaws.com/nonipesikiri/simple_definition_of_formalism.pdfIn PDF document text
    • https://s3.amazonaws.com/ruzaganog/ts_rto_vehicle_information.pdfIn PDF document text
    • https://s3.amazonaws.com/bevekizadoxuj/73347296344.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d729.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD729 5244 bytes
SHA-256: 0dded75dfad6d161abf6798bdd0435f56737d9e30fad8d421aafe3d6f70f0a04
font_01_sfnt_off0000e8d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8D9 11588 bytes
SHA-256: 9a4988585818893ac0b0da8e414e382e3c7830c36f9e01808a0f0f1056351bb2

Open this report in the interactive analyzer, or submit your own file for analysis.