Malicious PDF — malware analysis report

Static analysis result for SHA-256 b16c8fd79b27db65…

MALICIOUS

PDF

83.2 KB Created: 2021-01-12 00:17:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 4cf23199c38ee251e6d5c11b8a4e8f42 SHA-1: eb5bbfb7d760df5c2c1377e643fc95b234557775 SHA-256: b16c8fd79b27db6589d393007678d14979e701e55ca1478c2846ec8762cf8c70
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to suspicious or unknown domains, indicating a link farm or redirection scheme. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK specifically flags a link to 'traffking.ru', suggesting it leads to malicious infrastructure. While no scripts were explicitly extracted, the nature of the embedded links and the ML classification strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?utm_term=janatha+garage+audio+songs+please+come In PDF document text
    • https://nodopotol.weebly.com/uploads/1/3/4/0/134018708/ab012ccd.pdfIn PDF document text
    • https://site-1178040.mozfiles.com/files/1178040/extreme_car_simulator_2016.pdfIn PDF document text
    • https://site-1177644.mozfiles.com/files/1177644/95853798313.pdfIn PDF document text
    • https://luzidasagozoro.weebly.com/uploads/1/3/4/3/134319964/a9655c6b.pdfIn PDF document text
    • https://site-1168109.mozfiles.com/files/1168109/gravity_guy_unblocked_games_6969.pdfIn PDF document text
    • https://site-1176629.mozfiles.com/files/1176629/67945048110.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403127/normal_5fe0e1542d071.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385012/normal_5fd07a3a728a5.pdfIn PDF document text
    • https://site-1194964.mozfiles.com/files/1194964/sufidif.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gazivemon/possessive_pronoun_worksheets_7th_grade.pdfIn PDF document text
    • https://s3.amazonaws.com/tedowafomaru/vs_guidance_12001.3.pdfIn PDF document text
    • https://s3.amazonaws.com/zumomasugipeno/sebi_guidelines_for_issue_of_shares_ppt.pdfIn PDF document text
    • https://s3.amazonaws.com/fotojipifuzitul/16416429864.pdfIn PDF document text
    • https://s3.amazonaws.com/tesasubawalozan/best_cheque_printing_software_free.pdfIn PDF document text
    • https://s3.amazonaws.com/ruzaganog/stick_man_rpg_unblocked.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000f6df.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF6DF 13452 bytes
SHA-256: 6d4ffdfe03d27ffa27b95a5741e78088ba901def33ed76d172f3d4ed0d69608d
font_00_sfnt_off0000e471.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE471 5476 bytes
SHA-256: 74fb3c523aa19b5cccb8fbf4f010f30a1d148f53e65e134c2b61473e913e54b9
font_02_sfnt_off00011b98.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B98 10568 bytes
SHA-256: fc17c8bdef640dd9cb01c776124be0e3714d07c4bdf31fabf4983134ba804bfc

Open this report in the interactive analyzer, or submit your own file for analysis.