PDF malware analysis — malicious · a97fa322ebbaea3b

MALICIOUS

PDF

58.5 KB Created: 2020-11-14 16:23:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b0865fe84f494a52a5e8fd1fca4c4ffe SHA-1: 15015c411c1cc9890312a2714adbb88bb8ea4856 SHA-256: a97fa322ebbaea3b12e56f03b16fa0e0340f3d9134cf0ee2886357b517ff6aad

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical 'PDF_SEO_LINK_FARM' rule, indicating a large number of external links. The ML classifier and ClamAV also identified it as malicious, specifically as a phishing trojan. While no scripts were directly extracted, the presence of numerous external URLs, including one pointing to 'traffking.ru', suggests a phishing or malicious redirection attempt, likely delivered as a spearphishing attachment.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffking.ru/123?utm_term=center+charlie+hall+chords
- https://bapoxaluw.weebly.com/uploads/1/3/4/7/134717037/3af0492767d6.pdf
- https://cdn-cms.f-static.net/uploads/4415748/normal_5faa714e608a3.pdf
- https://cdn-cms.f-static.net/uploads/4378827/normal_5fa25f733e16f.pdf
- https://cdn-cms.f-static.net/uploads/4417212/normal_5fae7eea0b047.pdf
- https://cdn-cms.f-static.net/uploads/4427526/normal_5f9f617680cbe.pdf
- https://cdn-cms.f-static.net/uploads/4369647/normal_5fa4aab5bdffe.pdf
- https://cdn-cms.f-static.net/uploads/4415308/normal_5f96c3971326c.pdf
- https://cdn-cms.f-static.net/uploads/4417543/normal_5f9907bc77620.pdf
- https://cdn-cms.f-static.net/uploads/4403534/normal_5f9d893e20270.pdf
- https://cdn-cms.f-static.net/uploads/4423443/normal_5fae0156bac87.pdf
- https://nazivuwe.weebly.com/uploads/1/3/4/4/134452961/6d1fc51.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/lonozote/ritobevanivaw.pdf
- https://s3.amazonaws.com/xarojapi/caravaneer_2_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000aae6.bin` `adcaf5cbbae2533226cbbe087fb82b6e0540743c30051ebc5dee0e3718208390`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAAE6	4932 bytes
`font_01_sfnt_off0000bb9a.bin` `25304fa92e784e006e4a62e4bbe40536b1958e294efeec077ff07f7bb7cf649e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBB9A	9452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.