Malicious PDF — malware analysis report

Static analysis result for SHA-256 88681da1b7ae181d…

MALICIOUS

PDF

59.5 KB Created: 2020-12-20 16:00:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: c1ccdb0ac3036b4a279c0bd5bb8f629a SHA-1: 1e244b67f8626fca25d3bc2f7684d37b17121199 SHA-256: 88681da1b7ae181dd5f196ca8bc6927f8cf543707fc85997d5486ebb9ff78b92
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://traffmen.ru/123?utm_term=link%2527s+awakening+dx+rom'. Additionally, a machine learning classifier flagged the PDF with a high probability of being malicious. The presence of XFA forms and embedded URLs further supports its malicious nature, suggesting it's designed to lure users to a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/123?utm_term=link%2527s+awakening+dx+rom In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zugutixe/the_age_of_anxiety_auden.pdfIn PDF document text
    • https://s3.amazonaws.com/mamukawaxatali/suzurak.pdfIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/kidney_stone_laser_surgery_recovery_time_answers.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc34c7eea4a794d56549c18/t/5fc79da65fecd2174b654041/1606917543593/mars_retrograde_2020_scorpio_rising.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f91a7385-14a7-4938-b733-a1ad522585ac/mosatajepasupasilowalil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/84932b87-4a18-4aad-92d7-a9e1d8e1617b/gibesenofosopaxuwor.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6fde7d8e4f44799644325/t/5fcd750f33187724c406c1f4/1607300367811/bike_race_2019_kal.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc16c877848ba205d1c3861/t/5fc410e09ee0f32b87d2aa49/1606684897207/88584409149.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/edbaebdb-49ae-4e3e-9256-106af95d47cf/piviluri.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16c45c33-4929-4640-a4e1-75ab65ebfb52/angels_wife_lovers.pdfIn PDF document text
    • https://s3.amazonaws.com/wipotegadodorek/dixons_carphone_annual_report_2014.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d261dfe3-ca0c-45b4-904d-40f2399ab947/vusufibewojiragukufeni.pdfIn PDF document text
    • https://s3.amazonaws.com/dusubonifu/60862889216.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc069c17d0c8f249d3e4d8d/t/5fc22d7b9ee0f32b879c1437/1606561148595/6542318458.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ad09.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAD09 5312 bytes
SHA-256: d113f6dd56592e68f55ca01a1bd6b6f8106a84d6d8ee7d6d55e4aac460502d82
font_01_sfnt_off0000bf2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBF2F 10032 bytes
SHA-256: 3f711953c5ddf108db55400994c2b6f922027031b6510af7ecfbd901fe872f43

Open this report in the interactive analyzer, or submit your own file for analysis.