Malicious PDF — malware analysis report

Static analysis result for SHA-256 abc0e190c2f0d488…

MALICIOUS

PDF

110.7 KB Created: 2020-11-21 04:48:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: f847d316350aabb2a51b0e1a00b7355a SHA-1: 1cbd9f09b7b4f4c07a09d9681adade6d85312381 SHA-256: abc0e190c2f0d488edce2d9369e770254843a417bdd00daca276398d128c817b
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded links that point to known malicious redirectors and link farms, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly support its malicious nature. While no scripts were explicitly extracted, the PDF structure and embedded links are sufficient to infer a malicious intent to redirect users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?utm_term=bunny+girl+senpai+season+2 In PDF document text
    • https://xakekulipekez.weebly.com/uploads/1/3/4/3/134350488/3430b.pdfIn PDF document text
    • https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/1109957.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370529/normal_5fb482d72c935.pdfIn PDF document text
    • https://pudijubo.weebly.com/uploads/1/3/4/3/134311311/wetanapifujojot.pdfIn PDF document text
    • https://jevupatumatawi.weebly.com/uploads/1/3/4/3/134377955/jinawa_majajor.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470689/normal_5faf0b9549b61.pdfIn PDF document text
    • https://kiseridebajesa.weebly.com/uploads/1/3/1/4/131408791/zokiwotidosurovirike.pdfIn PDF document text
    • https://weniwekozeg.weebly.com/uploads/1/3/4/0/134012595/8841043.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://s3.amazonaws.com/wuxupewu/kadeji.pdfIn PDF document text
    • https://s3.amazonaws.com/wujapu/example_of_descriptive_quantitative_research_paper.pdfIn PDF document text
    • https://s3.amazonaws.com/satudifin/lease_agreement_form_nyc.pdfIn PDF document text
    • https://s3.amazonaws.com/gumagabu/make_a_fake_utility_bill.pdfIn PDF document text
    • https://s3.amazonaws.com/ropuba/dadikawuz.pdfIn PDF document text
    • https://s3.amazonaws.com/vavebufevodutob/road_and_building_engineering.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000113c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113C2 21004 bytes
SHA-256: e43609614cf705fe255fe5f62276df4bda7b8c3c010b8ac550ec8715e992287d
font_01_sfnt_off0001568e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1568E 5272 bytes
SHA-256: 8a274b8f6191dfa7d683a529a2ab49485e8aee28592d67e804099ef632ba5e98
font_02_sfnt_off00016892.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16892 10680 bytes
SHA-256: 16850b22333ac39de0c42cdb6ad57acfa6f6d7e30cbe4d56ad8f7b47ac028646
font_03_sfnt_off000186a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x186A4 11760 bytes
SHA-256: 567da844dd59ec426a016c0a66a5ee8b84d52ad856953b75fd4c95ff5a0b49bc

Open this report in the interactive analyzer, or submit your own file for analysis.