Malicious PDF — malware analysis report

Static analysis result for SHA-256 83c6503e4054c76b…

MALICIOUS

PDF

47.2 KB Created: 2020-11-06 19:57:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 30a1995c5808073cdfa83b09ed9c5da9 SHA-1: 726ab01f56b633b00292eec021bd0420a5a8e608 SHA-256: 83c6503e4054c76b0dd41fb95b64bb19e65d4b16344752341671d08053b89aa3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document, generated by wkhtmltopdf, contains a large number of embedded links, many of which point to external PDF files. The primary malicious URL identified is https://trafftec.ru/aws?keyword=auguste+comte+father+of+sociology, which appears to be part of a link farm designed to attract traffic. While no scripts were directly extracted, the heuristic firings indicate a pattern of SEO link farming within the PDF, suggesting an attempt to manipulate search engine results or drive traffic to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?keyword=auguste+comte+father+of+sociology PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8943c60b-9704-4e20-8b4c-c553df81c06f/41726534598.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/621d46dc-714a-440a-9ff1-45f350063ae8/80515275656.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/996de14d-9711-40ab-935b-d06b44cd53ea/fifa_16_3dm_crack_v1.pdfIn PDF document text
    • https://xuminewewebi.files.wordpress.com/2020/11/49179621743.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/348608a2-52ac-4040-a64e-cb2c0630b509/bulareruwoke.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9297a589-2390-4baa-88c7-20a491cb419a/39982604418.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11313ae9-ec88-4002-9088-cc89bf460d98/simulation_with_arena_5th_edition.pdfIn PDF document text
    • https://sisiviweze.files.wordpress.com/2020/11/50939477702.pdfIn PDF document text
    • https://sufuvuse.files.wordpress.com/2020/11/3074016501.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c1b3530-bedc-4d5d-9906-8eda517c7800/sofegitexurikod.pdfIn PDF document text
    • https://dutekosakiwe.files.wordpress.com/2020/11/riworujeruvarigikuga.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55eb1808-1037-4b8d-b65b-a08f4590a6ee/17275584768.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007942.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7942 5388 bytes
SHA-256: 5642143022d6b59ab964603fbe71e97b3360bfbfaf7c11e09522a1510361743a
font_01_sfnt_off00008b7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8B7B 11068 bytes
SHA-256: 5286c82ece200b42ffda5080b9ba8d5acfb7ac5f5f3480af9c3ead354b0f34fb

Open this report in the interactive analyzer, or submit your own file for analysis.