Malicious PDF — malware analysis report

Static analysis result for SHA-256 929366940536a42d…

MALICIOUS

PDF

108.0 KB Created: 2020-12-21 04:10:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7bbe9464a6f5e312d59fe1ec25fe578a SHA-1: 59a0fc1e5c90d7524637c363c4f0e38700029651 SHA-256: 929366940536a42dce731daf44ee24849e579945294e6f40ccba200f474beabc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a PDF link farm. The document body, though heavily obfuscated, suggests a lure related to 'Tractatus logico-philosophicus pdf español completo'. The presence of multiple Weebly-hosted PDF links indicates a potential phishing or SEO manipulation campaign. No scripts were extracted, but the overall structure and link farm heuristic point to malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/123?utm_term=tractatus+logico-philosophicus+pdf+espa%25C3%25B1ol+completo
    • https://fepobiwebefu.weebly.com/uploads/1/3/4/5/134592484/fudevakesegudif-nadid-nanekapeme.pdf
    • https://nokesopupikes.weebly.com/uploads/1/3/4/7/134767934/goxujum_zumama.pdf
    • https://mokitigek.weebly.com/uploads/1/3/1/6/131606839/musux.pdf
    • https://piwebodowumogoj.weebly.com/uploads/1/3/4/8/134857209/aef5fdfdce10b8e.pdf
    • https://gesinanafu.weebly.com/uploads/1/3/4/4/134481382/d8c42ca.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/cfa95c52-1b77-4b1c-9450-b5dffc3dad8a/15299080013.pdf
    • https://static1.squarespace.com/static/5fdcab432373c863b887b4f8/t/5fdd07b2ed5d2a1bbdf67c30/1608320947276/delta_model_14_bandsaw_manual.pdf
    • https://uploads.strikinglycdn.com/files/333ca43f-6d2f-4c77-9850-bc352744f9a7/46055277349.pdf
    • https://s3.amazonaws.com/dowadotiju/terufijovupoz.pdf
    • https://s3.amazonaws.com/godoremitiwuja/rexuperumuvifo.pdf
    • https://s3.amazonaws.com/zunaduxa/cheat_india_song_djjohal.pdf
    • https://s3.amazonaws.com/nimuwet/98963270819.pdf
    • https://static1.squarespace.com/static/5fce01bae1a8af6ff4aed778/t/5fd1841987bef85997e5ec38/1607566362489/knock_em_all_free_online.pdf
    • https://uploads.strikinglycdn.com/files/9c0e5ffd-b8cb-4cc0-8cfd-cbdf88ba6f5d/juvakapovuretunekoretikoz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016676.bin
11d18f57fc799b20d028e96c511b4dea66e4fa1239791be28d429f8965b56df0
pdf-font-stream PDF embedded font (sfnt) at offset 0x16676 5760 bytes
font_01_sfnt_off0001799f.bin
533a3060c4b0c59eb63f7d8c14fee4d784be208318c242ed4cf7a124f50e6b38
pdf-font-stream PDF embedded font (sfnt) at offset 0x1799F 11840 bytes