Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3fd7253b6f11cc5…

MALICIOUS

PDF

63.9 KB Created: 2020-12-08 16:27:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-04-10
MD5: 5fab9e5ec2e5929e3b8d036b3e863ec6 SHA-1: d776b161c95c49394b27296d59d29d3961e7a92e SHA-256: b3fd7253b6f11cc5ac46a3ecb67521700289d178adb5ee03fa4aa2acd9260d09
186 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/wb?keyword=raju%20bhai%20songs PDF link annotation
    • https://keregejuvuja.weebly.com/uploads/1/3/4/3/134345288/bawen.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373264/normal_5f8da38375808.pdfIn PDF document text
    • https://fipiwodumuxi.weebly.com/uploads/1/3/1/4/131453050/5781942.pdfIn PDF document text
    • https://kowabimope.weebly.com/uploads/1/3/4/3/134359524/905000.pdfIn PDF document text
    • https://viwuwobigoku.weebly.com/uploads/1/3/1/3/131378942/3013505.pdfIn PDF document text
    • https://vajibudutoneraz.weebly.com/uploads/1/3/4/3/134345344/nutivagedapelusive.pdfIn PDF document text
    • https://xelefivaj.weebly.com/uploads/1/3/4/2/134234850/7481822.pdfIn PDF document text
    • https://jalewigevat.weebly.com/uploads/1/3/2/6/132681207/1911800.pdfIn PDF document text
    • https:///\/a10.gaanacdn.com\/images\/albums\/10\/2712410\/crop_175x175_2712410.jpgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfdb13b8-3801-4b43-9044-5727386c9a65/raisin_in_the_sun_study_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77e3a09c-28b5-4808-b1a1-b1b08b4e2dd9/discovering_french_nouveau_blanc_2_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce0647ae-f472-46ed-b33c-c98c0795027a/28798651744.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44403da5-d556-4fc8-89ad-a1b7f9543c4c/47116599323.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d213a9fd-4248-4429-8260-e20ae2ce9254/fitbit_charge_2_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/xeropizuwe/48113144114.pdfIn PDF document text
    • https://s3.amazonaws.com/tokudapele/zunatofopufuwanaju.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bb8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB8A 5044 bytes
SHA-256: d07e15bbd4fcdfc221f22eb9ff0172979e2c2a11bac77779641c5f8f9ada2ff3
font_01_sfnt_off0000ccbb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCCBB 11096 bytes
SHA-256: c85ee6331ce826dba25fd2ff52f61f2914512a1acb18a69d0f66f9433ab01762

Open this report in the interactive analyzer, or submit your own file for analysis.