Malicious PDF — malware analysis report

Static analysis result for SHA-256 a60d04f63760ec44…

MALICIOUS

PDF

72.2 KB Created: 2020-11-25 11:02:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cb667b2ca738b47f763c14ab223ecdcd SHA-1: 18ad46e850d06f7255ee64435878b00c1fc8a874 SHA-256: a60d04f63760ec444f83b6a42de94b471e40f716484e5f721deb9029f0bd2b24
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics as malicious, specifically for containing links to known malicious redirectors and a link farm. The presence of embedded URLs and the ML classifier's high confidence score indicate a deliberate attempt to lead users to harmful content. While no scripts were explicitly extracted, the nature of the heuristics suggests the PDF's primary function is to facilitate malicious redirects.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?utm_term=tal%2527dorei+campaign+setting+%25285e+pdf%2529
    • https://sexozorojupur.weebly.com/uploads/1/3/4/3/134390270/07741b1.pdf
    • https://cdn-cms.f-static.net/uploads/4379049/normal_5f8e8f4aa3199.pdf
    • https://morupataniseb.weebly.com/uploads/1/3/4/5/134502176/wexeji-bifesotiko-ganeve-dibovatilova.pdf
    • https://cdn-cms.f-static.net/uploads/4391335/normal_5f8ff3c53a794.pdf
    • https://cdn-cms.f-static.net/uploads/4410204/normal_5fa39e72493f2.pdf
    • https://sozivutapadonen.weebly.com/uploads/1/3/1/1/131164462/6173703.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wovigebi/12889394022.pdf
    • https://s3.amazonaws.com/moxekibupuru/65769818773.pdf
    • https://uploads.strikinglycdn.com/files/74c8086c-7347-43ac-b490-f95255206ec6/unblocked_games_stick_war_2.pdf
    • https://uploads.strikinglycdn.com/files/e8f9c18c-a722-436d-8f76-e2164f2bfb0f/jaruvepavav.pdf
    • https://s3.amazonaws.com/dazemi/74508062696.pdf
    • https://s3.amazonaws.com/mijedusovineti/blackbird_tabs_guitar.pdf
    • https://uploads.strikinglycdn.com/files/3151895c-1def-48ac-82d1-5254fe4d98fc/las_3_preguntas_jorge_bucay_descargar.pdf
    • https://uploads.strikinglycdn.com/files/87036198-5442-4bc4-9eba-bb0a3057e878/74548492928.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0d0.bin
5d7ea3b8dbf2d4e339cafccc5ed67627d5fc1448feb3185394574ef2d95f56da		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD0D0 5736 bytes
font_01_sfnt_off0000e454.bin
a7c194c348f4bc26aad06ae1fa1eadf76503a3aca856ff80314c3d87a816eea9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE454 3720 bytes
font_02_sfnt_off0000efb4.bin
184fbcaeb2970b4eb64f8f853ff14c564df0635082237dde29520391f855edd8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFB4 10372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.