Malicious PDF — malware analysis report

Static analysis result for SHA-256 aacd39308bc692e6…

MALICIOUS

PDF

79.0 KB Created: 2020-12-21 18:44:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4510dfa72fc13ac7bff7d0ac1d72ef53 SHA-1: e1265079293541025556f271a6468b141605837a SHA-256: aacd39308bc692e604d4ab216e023384f745a7012299e893ce7337b0d472eb8f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan-like behavior. It contains a large number of external links, suggesting a link farm or redirection mechanism. The document body, though heavily obfuscated, hints at 'trending hashtags on instagram may 2020', likely a lure to drive traffic to the listed URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=trending+hashtags+on+instagram+may+2020
    • https://cdn-cms.f-static.net/uploads/4473039/normal_5fb2eb70acf34.pdf
    • https://cdn-cms.f-static.net/uploads/4450247/normal_5faa3f336dbd6.pdf
    • https://cdn-cms.f-static.net/uploads/4366009/normal_5f8fe18d31f21.pdf
    • https://xukolewijox.weebly.com/uploads/1/3/4/3/134320036/vizikaxokediguk-kajivakowoxu.pdf
    • https://cdn-cms.f-static.net/uploads/4370309/normal_5f89341bbee18.pdf
    • https://cdn-cms.f-static.net/uploads/4423714/normal_5fb6db5052878.pdf
    • https://cdn-cms.f-static.net/uploads/4450257/normal_5fd9f4883d075.pdf
    • https://static.s123-cdn-static.com/uploads/4366381/normal_5fcfa1646f61b.pdf
    • https://cdn-cms.f-static.net/uploads/4451230/normal_5fb43b42d52b1.pdf
    • https://xonokuraku.weebly.com/uploads/1/3/3/9/133988937/dorikagikopabup_girojepugoti_nobaxejadonifi.pdf
    • https://static.s123-cdn-static.com/uploads/4383802/normal_5fc8780d53699.pdf
    • https://cdn-cms.f-static.net/uploads/4375357/normal_5f8b1c88420a5.pdf
    • https://cdn-cms.f-static.net/uploads/4365553/normal_5f889ad731b29.pdf
    • https://static.s123-cdn-static.com/uploads/4460688/normal_5fde6513ba02d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static1.squarespace.com/static/5fdd37006394b41d6424d862/t/5fde783da3b92b153c2451f3/1608415294439/fotubuzod.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e348.bin
14bf2d46fa1ee73737793725ce08f3fc1890209436b9c6af08eef3f8a645164b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE348 5532 bytes
font_01_sfnt_off0000f5f3.bin
f2f7b48a7e0fedf5769de0f9e9d5fca7c56c66438c94375bd5a3970565cc7e45		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5F3 10296 bytes
font_02_sfnt_off0001196e.bin
c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1196E 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.