Malicious PDF — malware analysis report

Static analysis result for SHA-256 83c14152de7a0c5d…

MALICIOUS

PDF

72.8 KB Created: 2020-11-26 07:12:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: efae337baf02ae3a7494a5eec3221916 SHA-1: 7e6b77df8690c77152468afbdadeb8f9c8687e5d SHA-256: 83c14152de7a0c5d4a646b439b363be1000887eca85c3b0ad5d7e7f5401a9ed5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing attempt. The presence of an embedded URL and the ClamAV detection as Pdf.Phishing.Trojan further support this assessment. Although no scripts were explicitly extracted, the PDF structure and heuristics indicate malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=l+adjectifs+possessifs PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4500001/normal_5fb8813e13031.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369310/normal_5fb7a7c79c996.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418777/normal_5f9a4875d392d.pdfIn PDF document text
    • https://xomevore.weebly.com/uploads/1/3/4/3/134346529/nokepuk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d95f30b-90cd-4862-a4dd-adfd174177a6/jojo_part_5_manga_online.pdfIn PDF document text
    • https://s3.amazonaws.com/rezugekolaba/using_capital_letters_worksheet_grade_1.pdfIn PDF document text
    • https://s3.amazonaws.com/xapidajovaji/93108057781.pdfIn PDF document text
    • https://s3.amazonaws.com/pazerogasarinu/games_coming_to_game_pass.pdfIn PDF document text
    • https://s3.amazonaws.com/ninazarila/46143055008.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ba0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA0F 5036 bytes
SHA-256: 3f9410bce1d0af91dcdca0aa1a7db4c5bebb82ad8e6d02da9288050f79fbd52f
font_01_sfnt_off0000cb50.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCB50 2884 bytes
SHA-256: 5c558618dff369c2b900462a2c05a26cd535293f5b4c043723e2c7e55145be0c
font_02_sfnt_off0000d75c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD75C 12692 bytes
SHA-256: db1eb7914a6483906893aae50fd14c8e2f75b484d9563a3cc79d8240191840b2
font_03_sfnt_off0000ff29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF29 16208 bytes
SHA-256: c691c2dc236ff1c3149f8178f30dcb30456d959af2bd230901b395ad55359d31

Open this report in the interactive analyzer, or submit your own file for analysis.