Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7938bf7b0706a0e…

MALICIOUS

PDF

57.2 KB Created: 2020-11-07 14:52:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 062ee2bbf1db0d2b26dcc558b8c48376 SHA-1: d7173e4cb709a8eefca3a83708e524c9bc446bb1 SHA-256: a7938bf7b0706a0ed8b6e88fba00960ac01bba342282f5fbc6e7b2d40687e72b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains a large number of embedded links, with a significant portion pointing to external resources. The heuristic PDF_SEO_LINK_FARM indicates a mass of external links, and one specific URL, https://traffset.ru/123?keyword=us+army+abbreviation+for+master+sergeant, is directly referenced. While no scripts were explicitly extracted, the PDF structure suggests potential for embedded JavaScript or other active content that could facilitate redirection or further exploitation, aligning with a spearphishing attachment tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?keyword=us+army+abbreviation+for+master+sergeant PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4379615/normal_5fa3ec07dfdb8.pdfIn PDF document text
    • https://vapesokon.weebly.com/uploads/1/3/4/3/134329795/fuxikitesum.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377095/normal_5f8f754828c59.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b191bec-df3d-415e-ba87-0cf33ac7e3d2/71577294658.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f20f7c1-c046-45b5-bdfd-db99ed4ae868/statement_of_shareholders_equity_includes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/15c9fa39-fc16-47a3-bcbd-85207c70a5df/87062965881.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0bcd8321-050a-4492-a31a-4f9adda46e26/49860048177.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66406013-485a-4db0-a632-17c8b5417db6/24412727580.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68786d4d-bf02-4098-82e9-2656f1f9cde2/sakazororev.pdfIn PDF document text
    • https://vadazigifexe.files.wordpress.com/2020/11/gopiv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c9843b2-e30d-490c-9f4a-f689b6a07adc/94402391911.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74868531-c0fe-437e-87c6-c76e30486420/how_tall_was_allen_collins.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000076df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76DF 2888 bytes
SHA-256: 78885e247b1e7efa683895f67bcb90bf022b72a1a9e3ebb6f11a578be93ecb94
font_01_sfnt_off00008123.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8123 5348 bytes
SHA-256: d67459624c6c2817fb2c03b80472d43ebf84c3909b33b43cf30d155bb189d2d0
font_02_sfnt_off00009355.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9355 13220 bytes
SHA-256: 643898d64cae347d5402884bf0459c303c50d4679e7ad9f42c35ea7e9239aaf1
font_03_sfnt_off0000bfbe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBFBE 16712 bytes
SHA-256: 1a9d02ae05aa860a658d0daf900d80c0b2dfcf1b5d4a2784324b8f40949a1b39

Open this report in the interactive analyzer, or submit your own file for analysis.