Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6717b697a28c4a7…

MALICIOUS

PDF

61.0 KB Created: 2020-12-16 08:21:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c51cc5a6429a0fc0a73e57d3cf0a2cca SHA-1: 16e1c81883f0509be9c8f0def1b2508d4e8dd1c0 SHA-256: b6717b697a28c4a7e1a3bdb6209fcd97b7f50d7674642a5909b09487b4813d3b
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with several pointing to known malicious redirector infrastructure and a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent. The primary function appears to be directing users to external, potentially malicious, websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=pestana+surgery+notes+pdf+reddit
    • https://rirusiwox.weebly.com/uploads/1/3/4/2/134265342/7096377.pdf
    • https://mufedagejex.weebly.com/uploads/1/3/4/7/134726032/lorubavevotu.pdf
    • https://wenexirotupunam.weebly.com/uploads/1/3/4/7/134736105/1854114.pdf
    • https://lulakoxefinadi.weebly.com/uploads/1/3/4/3/134332070/wexaki.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/najubu/zuru_hamster_toys_cheap.pdf
    • https://s3.amazonaws.com/fekazudabo/99725871837.pdf
    • https://s3.amazonaws.com/jiwotarotavuz/cholesterol_levels_nhs_guidelines.pdf
    • https://static1.squarespace.com/static/5fcec0c8527e39196677e8f6/t/5fcfff70d2669313d1b9421f/1607466865819/warowulavap.pdf
    • https://static1.squarespace.com/static/5fc153656609fd0ee79445da/t/5fcc81da1e1a4d7de1241494/1607238115756/xebazo.pdf
    • https://s3.amazonaws.com/gotenukevepunin/beridet.pdf
    • https://static1.squarespace.com/static/5fc53b22bf71053ccb2c19db/t/5fcb7ebf6e74d26c6fffea58/1607171775590/61655449722.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4ec9f81c9a2a0c988550/1606373066315/bdo_xbox_next_class.pdf
    • https://s3.amazonaws.com/nabifovu/zuroxozaniwetipepito.pdf
    • https://uploads.strikinglycdn.com/files/1be8782a-5b50-482e-83c5-0e848312ad34/google_drive_captain_america_the_first_avenger.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b15d.bin
0201952617d610b74c25c2e31ecdcd661b66f9df0f0319c3d53a145081f7e361		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB15D 5280 bytes
font_01_sfnt_off0000c36f.bin
d9f4e128584c54acd844add941e0730dd555f3e11b7eff4762fc38ee0b323a96		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC36F 10564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.