Malicious PDF — malware analysis report

Static analysis result for SHA-256 95ba988d9fcf9860…

MALICIOUS

PDF

51.9 KB Created: 2020-11-09 01:29:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 283766aa457c9b57a46cd5a6801614a5 SHA-1: 784450f2c153e52c01c3217357270f9b9d9e075c SHA-256: 95ba988d9fcf9860fd6daf1a0789b630b23029b4821a4d8c50add62e45c6c638
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, with one prominent URL pointing to 'traffking.ru'. The ML classifier strongly indicated maliciousness, and the presence of numerous PDF links suggests an attempt to manipulate search engine results or redirect users to potentially harmful content. No scripts were extracted, but the structure and URL patterns are indicative of a malicious SEO or content redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?keyword=annotated+bibliography+example+apa+6
    • https://cdn-cms.f-static.net/uploads/4365602/normal_5f8e6b175ea5a.pdf
    • https://pevugubak.weebly.com/uploads/1/3/2/7/132740457/f999395.pdf
    • https://zotadipijipas.weebly.com/uploads/1/3/4/4/134467791/5734854.pdf
    • https://cdn-cms.f-static.net/uploads/4382627/normal_5f98df11029ce.pdf
    • https://cdn-cms.f-static.net/uploads/4446761/normal_5fa41da67e0e5.pdf
    • https://cdn-cms.f-static.net/uploads/4369520/normal_5f9d0e702acbf.pdf
    • https://cdn-cms.f-static.net/uploads/4447663/normal_5fa86b0d5529d.pdf
    • https://cdn-cms.f-static.net/uploads/4383692/normal_5fa1ea6170a9e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/642f5cd9-16bc-4d51-b93e-2d607d9388ad/sifobovateverevom.pdf
    • https://uploads.strikinglycdn.com/files/716468d0-c453-4e3d-9130-46427ecba655/47093647518.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000647d.bin
29f4235c26ab4fd9125fd65ba1c4b408e78ea5d0cb4f445e8065843f380b76ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x647D 11620 bytes
font_01_sfnt_off00008a1d.bin
29c238c4bacbbd63d5f4be83e6797cabf2ade1440e9421b8415a907b235ab324		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A1D 5648 bytes
font_02_sfnt_off00009d2e.bin
2dd11221bd4f41a6d649fb53f82ec5739eb5cfcc9a791ccedb6de1d2bb3ea703		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D2E 11420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.