Malicious PDF — malware analysis report

Static analysis result for SHA-256 a44c6b4c9c3cce68…

MALICIOUS

PDF

82.0 KB Created: 2020-12-17 23:02:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2b545b67e4dad099208e36ceac901862 SHA-1: 1e2ce3eb3a44ce3efb6a3235841383054c485676 SHA-256: a44c6b4c9c3cce6868e34ef444fffc206109ae84f1f4beb371f7ac0bd5fbe6c5
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to redirectors and link farms, indicating a malicious intent to drive traffic to potentially harmful sites. The ClamAV detection and ML classifier further support its malicious nature, classifying it as a phishing trojan. No scripts were extracted, but the embedded links are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=trunature+ginkgo+biloba+costco
    • https://biwizodem.weebly.com/uploads/1/3/4/6/134650183/jiwekopi.pdf
    • https://cdn-cms.f-static.net/uploads/4482870/normal_5fd2a1e8db68d.pdf
    • https://napuraviseso.weebly.com/uploads/1/3/4/3/134322211/8229549.pdf
    • https://cdn-cms.f-static.net/uploads/4422909/normal_5fa260160b919.pdf
    • https://lisoletabe.weebly.com/uploads/1/3/4/5/134511207/3381957.pdf
    • https://jenitexul.weebly.com/uploads/1/3/4/8/134859983/e3c17d6c5a96.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://static1.squarespace.com/static/5fc56d9988c99b6d37c5c202/t/5fc65ffe3c6ccf69f3391347/1606836223313/msx2_emulator_online.pdf
    • https://static1.squarespace.com/static/5fc0012c12facd59cea80d2a/t/5fc171339ee0f32b87897535/1606512948886/lesson_4_sentence_completion_answers.pdf
    • https://static1.squarespace.com/static/5fc5d95bbdb33045eee4110e/t/5fc60f48f8cdb769c6b32bb2/1606815564707/90032526416.pdf
    • https://uploads.strikinglycdn.com/files/87c5d1dc-215c-4470-bdd8-5959e1c3f3ff/estrategias_de_enseanza_y_aprendizaje.pdf
    • https://static1.squarespace.com/static/5fc1dda692c50b1a1e7e4a1d/t/5fc513fd3c02f22b9dad4d9e/1606751232130/icassp_2020_deadline.pdf
    • https://s3.amazonaws.com/tixedujegibex/ascp_phlebotomy_study_guide.pdf
    • https://static1.squarespace.com/static/5fc5176dd49dd124474f549c/t/5fc6cc584f9413233b0d1ae3/1606863961211/football_referee_supplies.pdf
    • https://uploads.strikinglycdn.com/files/1a559fef-2ad1-4531-81ea-c5910b04120e/2726513230.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b73b.bin
fe59877b0a34e2b5a66ad2f18d091f9568870410ebd3a9b715f8fedb7b8e5508		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB73B 19108 bytes
font_01_sfnt_off0000f402.bin
ce27388dcf9133ca606cfa4d04e08bb0f4191c70cbf7fbe926dec16553c1fb65		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF402 5000 bytes
font_02_sfnt_off0001050c.bin
591c4f1fd5a97ef90810462ba42b2f46b121f60b389350e109fbee84de555128		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1050C 10892 bytes
font_03_sfnt_off00012a0c.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A0C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.