Malicious PDF — malware analysis report

Static analysis result for SHA-256 9431d86154d23a43…

MALICIOUS

PDF

67.4 KB Created: 2020-11-19 23:45:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eefbbf3df3054a5d681816d3151627d8 SHA-1: 65ef3f5d852d6f5b057d960383ba3eeb886c9cdd SHA-256: 9431d86154d23a43336473708ffd277232a17ea02a050794bdbaa1032dfd1bfe
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file was identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged as a phishing trojan. It contains a significant number of embedded links, forming a link farm, with the primary redirector pointing to a suspicious domain. The document body is heavily obfuscated and appears to be junk data, suggesting the primary purpose is to host these malicious links rather than provide user-facing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/aws?utm_term=printable+worksheets+for+kindergarten+math
    • https://moxuronanupew.weebly.com/uploads/1/3/4/5/134597487/7e4f4.pdf
    • https://cdn-cms.f-static.net/uploads/4389104/normal_5fb294fad1add.pdf
    • https://wejibuxod.weebly.com/uploads/1/3/0/7/130740202/f0272.pdf
    • https://pevinuwipe.weebly.com/uploads/1/3/0/8/130873962/pagedomenugoxudujok.pdf
    • https://cdn-cms.f-static.net/uploads/4393348/normal_5f9ac32f434d8.pdf
    • https://cdn-cms.f-static.net/uploads/4371514/normal_5fa4822b7aa43.pdf
    • https://terarawuterojuz.weebly.com/uploads/1/3/0/7/130739827/6febba2b6.pdf
    • https://cdn-cms.f-static.net/uploads/4382189/normal_5f9ee3d9886c8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/25805397-ca8e-44fa-aab5-fba9842da8c6/humorously_speaking_manual_online.pdf
    • https://s3.amazonaws.com/xakapudakadu/mpcb_schneider_catalogue.pdf
    • https://s3.amazonaws.com/xifabilejilab/54073954832.pdf
    • https://s3.amazonaws.com/napoledunadigo/desolate_parents_guide.pdf
    • https://s3.amazonaws.com/diwitapezu/zuxilepisodatoxuratuna.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cab0.bin
1b17b8118d48f8c78ef299d214a3c505f07b1a227764586623a757a867b5caa7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCAB0 5620 bytes
font_01_sfnt_off0000ddaf.bin
bcd291cda49825bf5267d21d32623ad22cddecf4378dc62eb745113dab2ebede		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDDAF 10192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.