Malicious PDF — malware analysis report

Static analysis result for SHA-256 8bdb8a2fe61282ac…

MALICIOUS

PDF

55.1 KB Created: 2020-11-18 13:50:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b9eb807d06f18b95f61e24ef09cd3398 SHA-1: 118c3603cfe575a65a324191565c456f60371e15 SHA-256: 8bdb8a2fe61282ac0f310064510cc56080fb7a53938ce3e46ca96d95471928b2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains a large number of external links, many of which are hosted on S3 buckets and appear to be part of a link farm for SEO manipulation. One of the extracted URLs, 'https://traffking.ru/aws?utm_term=tamil+songs++starmusiq+2015', is flagged as unknown reputation, suggesting a potential malicious destination. The ClamAV detection and ML classifier also indicate maliciousness, with the heuristic 'PDF_SEO_LINK_FARM' strongly suggesting an attempt to distribute content or malware through a network of linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9818

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?utm_term=tamil+songs++starmusiq+2015
    • https://cdn-cms.f-static.net/uploads/4454055/normal_5fa3089e6909b.pdf
    • https://pudegubazamase.weebly.com/uploads/1/3/1/1/131163945/393e87e78b619.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xuxifuzituwu/personal_protective_equipment_definition.pdf
    • https://s3.amazonaws.com/tejuvonixag/the_day_the_internet_died.pdf
    • https://s3.amazonaws.com/wilugugo/rudufowo.pdf
    • https://s3.amazonaws.com/titugome/tuvibewujezopuz.pdf
    • https://uploads.strikinglycdn.com/files/82ce2358-70d5-400f-99eb-578a52aaf3b8/mnps_calendar_2019_2020.pdf
    • https://s3.amazonaws.com/migivewuwe/wave_motion_notes_in_hindi.pdf
    • https://s3.amazonaws.com/gupuso/nogigaxewusesad.pdf
    • https://s3.amazonaws.com/bezutu/vuzajijunilitixorutajexet.pdf
    • https://s3.amazonaws.com/vukumesoj/bright_futures_renewal_requirements_ucf.pdf
    • https://s3.amazonaws.com/bulolimepol/bamu_university_time_table_2018.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c941.bin
194dcec20d4dec34adc8ae0fee7b9bb4e20bb3f8e23a7ca5dc587a0ded25868b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC941 5528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.