Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8d74434beb02ff7…

MALICIOUS

PDF

75.3 KB Created: 2020-12-21 19:34:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12ca1a0580aaffdf674b993b9c6de935 SHA-1: dbb3f8b894e3b67ed96940756210e52294b2103e SHA-256: a8d74434beb02ff7c68ee6eed00e7bad61acf71680d39b872a02a6b3e3bb8f36
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or SEO manipulation tactic. One of the embedded URLs, 'https://traffking.ru/aws?utm_term=cursive+alphabet+practice+worksheets+pdf', appears to be a lure, potentially leading to further malicious content or phishing pages. The presence of embedded JavaScript, though not explicitly detailed in the provided evidence, is a common vector for malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?utm_term=cursive+alphabet+practice+worksheets+pdf
    • https://joxunirefebemi.weebly.com/uploads/1/3/4/3/134319414/notodiwoforipipur.pdf
    • https://bebujufexuxiki.weebly.com/uploads/1/3/4/6/134624407/1dceaf8db67.pdf
    • https://wabebapag.weebly.com/uploads/1/3/4/3/134335427/6720394.pdf
    • https://cdn-cms.f-static.net/uploads/4423750/normal_5fb7155c78ada.pdf
    • https://cdn-cms.f-static.net/uploads/4491152/normal_5fb2de3320830.pdf
    • https://sijevunima.weebly.com/uploads/1/3/1/8/131859613/retus_nivof_rowepezise_dipole.pdf
    • https://static.s123-cdn-static.com/uploads/4392862/normal_5fdee7dd6eb7d.pdf
    • https://cdn-cms.f-static.net/uploads/4426425/normal_5fda012cc4694.pdf
    • https://static.s123-cdn-static.com/uploads/4368958/normal_5fddd0a75a13f.pdf
    • https://pejilajapife.weebly.com/uploads/1/3/4/4/134477767/rulugatelape.pdf
    • https://jarapitoxedomel.weebly.com/uploads/1/3/1/4/131437170/4517271.pdf
    • https://cdn-cms.f-static.net/uploads/4380083/normal_5fb27312b39b2.pdf
    • https://cdn-cms.f-static.net/uploads/4413111/normal_5fbcf576eadf9.pdf
    • https://cdn-cms.f-static.net/uploads/4394066/normal_5fa19c858a805.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static1.squarespace.com/static/5fc376e18139af0376556c03/t/5fc77affe2dcb1274df0f65d/1606908674479/vewufudiwixaxi.pdf
    • https://static1.squarespace.com/static/5fc78c2744e997374a2d5021/t/5fce048b33187724c4172d36/1607337099866/herpes_simplex_2_test.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfc9.bin
c663e6ec0e1d776a3c82409634a297d4ae613347075fff3d2760e4312fb621f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFC9 5504 bytes
font_01_sfnt_off0000f281.bin
e9a5a1f6ed95b1e3669933bb00002ad32a1708c3e0b735191cad5e02368a6c7d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF281 1800 bytes
font_02_sfnt_off0000fb0f.bin
6dd41d44a5de5542e692be0e5c6fee9a892f0ad39fa64d0de7449a9e19e13ef5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB0F 10768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.