Malicious PDF — malware analysis report

Static analysis result for SHA-256 83f186e6607d1659…

MALICIOUS

PDF

59.3 KB Created: 2020-12-17 07:20:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 5c908b7f3f9c7a5615ef2c5768be8bde SHA-1: b36674ad34732fe12cbe59fcac7b4ec841fd4347 SHA-256: 83f186e6607d1659adc25e2619e83cbbf4ef3e8ade707d32dd5f4022a282cb0d
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which points to a known malicious redirector (ggtraff.ru). The document body, though heavily obfuscated, contains text that could be used as a lure. The presence of a malicious redirector and a ClamAV detection for Pdf.Phishing.Trojan strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?utm_term=california+board+of+cosmetology+twitter In PDF document text
    • https://cdn-cms.f-static.net/uploads/4408324/normal_5f9ac6b1e5805.pdfIn PDF document text
    • https://dobamadolexazi.weebly.com/uploads/1/3/4/4/134478964/9548778.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc30fa5bda9c57a97cc46e9/t/5fd16e3323f2866aa37d7f40/1607560755809/tumblr_girl_drawings.pdfIn PDF document text
    • https://s3.amazonaws.com/bubodeliza/acordes_de_guitarra_acustica_canciones_cristianas_faciles.pdfIn PDF document text
    • https://s3.amazonaws.com/gawabog/29525571897.pdfIn PDF document text
    • https://s3.amazonaws.com/nitajosasa/riferugivitufawat.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf149b4c4d833b8bc80f0/1606218059145/fotegasezuwajaf.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc51ee2405d5340f344f969/t/5fd12dd25767704c6ef3c98f/1607544275008/how_often_to_water_small_snake_plant.pdfIn PDF document text
    • https://s3.amazonaws.com/migivewuwe/xoxirejetu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc54ae52cf09257bd88a4a3/t/5fd185d5a9eaf43bd84cc3f8/1607566805137/68090504201.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5d9ef81c9a2a0c9997bb/1606376865415/blown_to_bits_chapter_6.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ad3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAD3A 5580 bytes
SHA-256: 6ddc7be624a61da1c18a434fe2cb14ec931a88c026c605aba678575578cd37de
font_01_sfnt_off0000c02b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC02B 9492 bytes
SHA-256: 6d7e419bd33deff83588317c4b7f97f2e540a1ceaa93dd5f18fdbd2373b8ef2d

Open this report in the interactive analyzer, or submit your own file for analysis.