Malicious PDF — malware analysis report

Static analysis result for SHA-256 abed6e784a19d378…

MALICIOUS

PDF

71.9 KB Created: 2020-12-06 22:01:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: b3c5ac14bd76dec42f85d861619ef3d9 SHA-1: 5a7fbfe58d50db60195c5c0f2a149b0b9cda199a SHA-256: abed6e784a19d378b266d45f3ad32d089d4681ee3db191c8ccb128b910a577dd
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'traffmen.ru'. Additionally, a machine learning classifier and ClamAV both flagged the file as malicious, specifically as a phishing trojan. The embedded URL is the primary indicator of malicious intent, likely serving as a lure to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/123?utm_term=cosine+rule+for+angle+bbc+bitesize In PDF document text
    • https://kukezuleji.weebly.com/uploads/1/3/4/3/134361302/wutav.pdfIn PDF document text
    • https://dejuxowiku.weebly.com/uploads/1/3/0/7/130738850/306451.pdfIn PDF document text
    • https://pepomujotopulog.weebly.com/uploads/1/3/4/8/134873529/bukute_morusukorigix_nipafaxeb.pdfIn PDF document text
    • https://fosozenasavo.weebly.com/uploads/1/3/4/8/134889966/negemogemezone.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc2a5ae27a199023ac0a057/t/5fc4d66c61e25426e1d00909/1606735468358/81149035262.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf658a5147b148042b5852/1606378891450/lifetime_fitness_columbia_jobs.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc64fea085bf90c0e22058c/t/5fcc8ade74a40730fb9360f4/1607240414946/fruit_ninja_angry_birds_android.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2d442e9fc3622d52eb2cd/t/5fc5ee43f81c9a2a0c704545/1606807112332/58522785212.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0d8d024b06a7eb3fedc56/t/5fc2c289173fb5383bfe5dbe/1606599305747/1_on_1_soccer.pdfIn PDF document text
    • https://s3.amazonaws.com/vukusa/linear_mdkp_radio_keypad_programming_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/rakabexozu/diccionario_juridico_elemental_cabanellas.pdfIn PDF document text
    • https://s3.amazonaws.com/zafaronivaj/71708889552.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc50b2968612547ed78a8d7/t/5fccd1d3662d5e24e0a09c1b/1607258580304/space_rangers_quest_apk.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c326.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC326 5144 bytes
SHA-256: 354442eb302aba1dbcdf0bc4157a4275b2d6974ca2d74559988faea6bff70ef3
font_01_sfnt_off0000d4ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4BA 12292 bytes
SHA-256: 4b42aa379c756221456ebca62a1656187151792f7702ac13fb228657acaa9948
font_02_sfnt_off0000fda7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDA7 16176 bytes
SHA-256: 0435b8591733cab3dd00ae6bf7f3583f52f98818fdbefa712b201e0f2595db92

Open this report in the interactive analyzer, or submit your own file for analysis.