Malicious PDF — malware analysis report

Static analysis result for SHA-256 b4357f6c3ef30ac8…

MALICIOUS

PDF

80.8 KB Created: 2020-12-29 16:52:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 891ef55a51b67603ca382f7c5ce8e1af SHA-1: 12ce05437a80658a85780239dc514d47b7f4fbca SHA-256: b4357f6c3ef30ac82b924f5deb8dfe59fee4b7f60102a300594ee140fdac76ea
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent URL pointing to a suspicious domain associated with a cracked software lure. ClamAV and ML classifiers strongly indicate maliciousness, classifying it as a phishing trojan. The presence of embedded URLs and the overall structure suggest an attempt to redirect users to malicious content, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=screen+stream+mirroring+apk+cracked
    • https://sakenudawajaka.weebly.com/uploads/1/3/4/5/134595508/liwesotigi-wasedojij-dalaxofijenase.pdf
    • https://cdn.sqhk.co/ravawiku/2jbgdgc/shadow_the_hedgehog_wallpaper_iphone.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/midizaxopazeji/can_you_browser_on_apple_tv.pdf
    • https://uploads.strikinglycdn.com/files/7546abae-2e92-415d-8433-eb7a8e61c9c8/9797238458.pdf
    • https://uploads.strikinglycdn.com/files/2d424717-b4e4-4228-b280-eb1ba180397a/harry_potter_4_screenplay.pdf
    • https://uploads.strikinglycdn.com/files/9f4b965d-8501-488d-a338-2185b4ff949a/diversified_maintenance_florida.pdf
    • https://uploads.strikinglycdn.com/files/0dd4965f-0dc4-4399-bb31-c91af876628c/falidovefo.pdf
    • https://uploads.strikinglycdn.com/files/3c07958f-7ea3-45f0-b559-3c4871f1f802/lock_screen_ios_9_-_iphone_7_apk.pdf
    • https://uploads.strikinglycdn.com/files/91f067a6-3388-4260-83d7-01a9d8b8474b/soundlogic_xt_2200mah_manual.pdf
    • https://uploads.strikinglycdn.com/files/1d05d818-16a6-473b-b388-ba0ca0990fe1/11904204287.pdf
    • https://uploads.strikinglycdn.com/files/21d14b9f-19a4-4d0d-b165-427ade127c08/vanojirudemimewirobi.pdf
    • https://uploads.strikinglycdn.com/files/74c01233-4005-4ef4-9d18-096d63c5bd10/42271051339.pdf
    • https://uploads.strikinglycdn.com/files/8d5028ea-d69d-4720-b058-ac17794e2a4a/ap_physics_1_formula_sheet.pdf
    • https://uploads.strikinglycdn.com/files/59edb654-37d0-4e5d-b4c8-30f2a4118970/64694716630.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e534.bin
21bf55f2f1240929e8bf4e5c7588b9a7026cc71b150d980324f41b331c051514		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE534 5528 bytes
font_01_sfnt_off0000f7f0.bin
f146f06cacd012d6d42d8ce46f099c0f4b2f894dcfd3620fb365a1fe6cb206a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7F0 13056 bytes
font_02_sfnt_off00012122.bin
2a5f1667c2e343500efde63e3dd6a136498333968b1680966ac5eb34589f1174		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12122 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.