Malicious PDF — malware analysis report

Static analysis result for SHA-256 a38f51de4d08c027…

MALICIOUS

PDF

60.5 KB Created: 2020-11-23 22:26:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: deef89b3df813f0e8f74af969ca4e72e SHA-1: 7c36ceccf5038f330298daeeb3304a4c9bc8a66e SHA-256: a38f51de4d08c02734ba3fa6f571c78b48bc031a5874375579d78d32bffbaa2a
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by multiple heuristics and an ML classifier. It contains a large number of external links, suggesting a link farm or phishing attempt. One of the extracted URLs, https://traffset.ru/123?utm_term=crisis+of+conformity+vinyl, is flagged as unknown reputation and is likely a malicious destination. The document body is heavily obfuscated and unreadable, but the presence of PDF_SEO_LINK_FARM heuristic indicates a deliberate attempt to create a large number of links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=crisis+of+conformity+vinyl PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4379964/normal_5f90e08a93330.pdfIn PDF document text
    • https://wiwawuvagowe.weebly.com/uploads/1/3/4/4/134496439/suriforinisirovezi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389376/normal_5f9086497792f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372985/normal_5fa793f2a674a.pdfIn PDF document text
    • https://lusefova.weebly.com/uploads/1/3/4/5/134583673/zuribegi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d545eba5-057f-460c-b466-acc070f9541c/medieval_times_worksheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8cbffd1-efb9-445c-ab97-001aa73c220a/84606473286.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a1a8ca2-9d73-40a1-b127-9b07b7ab1b9c/oregon_uniform_citation_and_complaint_options.pdfIn PDF document text
    • https://s3.amazonaws.com/pezofut/atkins_physical_chemistry_10th_edition_solution_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54ae514a-9fd0-4d71-8424-bcaf1505f21a/rematulugigupogexapudufa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b79f529f-b318-41a3-b655-341e4def6264/santa_lucia_fc_malta.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3df6ea93-0b77-4bb9-907c-f72885b0d5cd/hot_wheels_sizzlers_cars.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d16b95c4-abd2-4a89-960a-83d8530d0279/70424767212.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86bc5c49-d6ca-4205-a145-1ec2f901d38e/lana_del_rey_born_to_die_full_album_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b0f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB0F9 4884 bytes
SHA-256: 73e4c859a8bfb6f4bd55a23c652073e223334a412cd2823a143d74f46adf9dc7
font_01_sfnt_off0000c18e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC18E 10280 bytes
SHA-256: 1b574f7b9d8599795493a67610d8df1d623ba777ff9ca6314762024f26d86974

Open this report in the interactive analyzer, or submit your own file for analysis.