Malicious PDF — malware analysis report

Static analysis result for SHA-256 b64cd41f89db1f2b…

MALICIOUS

PDF

109.1 KB Created: 2020-12-02 11:58:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: d4568fce424ad82cf384e7f98338293c SHA-1: 1c2880c5f2f83788c680cee89e17ecf66dd35fc5 SHA-256: b64cd41f89db1f2b42810aca126a451abcb7961435f6d5632398618f3e07df4c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of embedded external links, flagged by the PDF_SEO_LINK_FARM heuristic. One of these links, 'https://trafftec.ru/123?utm_term=x+ku+band+frequency', is suspicious. While no scripts were directly extracted, the presence of numerous links suggests an attempt to direct users to potentially malicious or deceptive content, aligning with a phishing or SEO spam attack pattern. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=x+ku+band+frequency PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4461773/normal_5fc1d9cc947ea.pdfIn PDF document text
    • https://sumigixutaruxaj.weebly.com/uploads/1/3/4/7/134748626/9608717.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381344/normal_5f99a5abe2cf0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0c3a6f0-7a42-4894-a85a-db8217222cbe/38894703743.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8ac4665-33a1-47fe-8da4-c17ce0165f03/calculus_concepts_and_contexts_3rd_e.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/deb54368-5049-4291-8d65-22ffaf4409b5/99522536393.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf1b17acac6192a85a5a9/1606283698223/practice_codominance_and_incomplete_dominance_answer_key_horses.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b828008f-0c1c-4981-8163-932bf2fd2fac/36079459259.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc13a23affbf90a66eca3c4/t/5fc36599f8cdb769c64ea76d/1606641049831/pentair_intellichlor_ic40_warranty.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75e920c2-87cf-42ba-9f01-2b1aa9db8bda/9994403662.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5a3a111f6a41984a5f629/t/5fc760534f9413233b2074b2/1606901844757/bobadonitavuluwatil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/13b13df9-0c27-4f4e-abbd-00a0f7228d69/xudoxusexovemo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf67ec18e72e5fdbd00202/1606379500368/wesumaxonejutopawe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016ebc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16EBC 5212 bytes
SHA-256: 78a1687d2e26b946f319427d25ad3c614f76997dbb272c98ff4da2c16f827d69
font_01_sfnt_off0001808d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1808D 11768 bytes
SHA-256: 5bebfa1f71313cdbaea7ea8fe6c0d534ce5f9db9b5f376e0b243f004c9e032c8

Open this report in the interactive analyzer, or submit your own file for analysis.