Malicious PDF — malware analysis report

Static analysis result for SHA-256 be20148d187879c0…

MALICIOUS

PDF

118.0 KB Created: 2020-12-06 07:15:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6bb0f857a230e8b5696c689c8d926864 SHA-1: 95344f5bfa88ccf42da0e561077d2b8553f7751d SHA-256: be20148d187879c0e7d98263f677d7c99830f51537ed082117126bec83d4579b
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by multiple heuristics and a machine learning classifier, indicating a high likelihood of malicious intent. It contains a link to a known malicious redirector, 'traffmen.ru', which is likely used to distribute further malware or conduct phishing. The presence of numerous external links, many pointing to S3 buckets, suggests a link farm or a method to obscure the ultimate destination. The document body, though heavily obfuscated, contains text related to a 'Season 9 tier 100 skin', likely a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9904

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/strik?utm_term=season+9+tier+100+skin
    • https://sexozorojupur.weebly.com/uploads/1/3/4/3/134390270/xugiva.pdf
    • https://rikurifijuse.weebly.com/uploads/1/3/4/6/134681474/rezovovob.pdf
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102Hussain
    • http://smc.org.inhttp://smc.org.in
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • http://fedorahosted.org/lohit
    • https://s3.amazonaws.com/tigovatolis/rutuvitixulefiv.pdf
    • https://s3.amazonaws.com/feseni/formation_de_l_ion_hydrogne.pdf
    • https://s3.amazonaws.com/garorowa/tekazuperupuwovuz.pdf
    • https://s3.amazonaws.com/najipavez/how_to_change_android_opening_logo.pdf
    • https://s3.amazonaws.com/tenunud/formal_letter_asking_for_holiday.pdf
    • https://s3.amazonaws.com/fibesezati/guns_of_glory_cheat_network.pdf
    • https://s3.amazonaws.com/fekazudabo/kupejewidob.pdf
    • https://s3.amazonaws.com/purufiz/nokinifagazalun.pdf
    • https://uploads.strikinglycdn.com/files/6aff736c-ba39-45fd-909d-be10cdb7ea6c/gevamumox.pdf
    • https://uploads.strikinglycdn.com/files/a70957e7-d06a-4c79-a80c-43efcb7da046/que_es_el_ms_dos.pdf
    • https://s3.amazonaws.com/garorowa/12228464927.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://gitlab.com/smc/meera/blob/master/COPYING
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off000128b1.bin
57aabc152601f762a98964a72f84827291b5225c8b81d43819b1fb429eadb51d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x128B1 4156 bytes
stream_009_off00018f5a.bin
ab796821d10e14be76a6d126d70e3ff23c723eb44964688f4eb6eda60f59de02		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18F5A 24888 bytes
font_00_sfnt_off0000fae7.bin
4d70c613f3231daedf2b0539eb1127b8fbf090a9137c7daf8b180fb2c15dc9fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAE7 8484 bytes
font_01_sfnt_off00011722.bin
ef97a452424710a1e8c6c584efaac9a6b72ef820b6f60714e146a1021f18090e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11722 5164 bytes
font_03_sfnt_off00013857.bin
669369ce7008bc1f363c1c78cfc288ca8051bc44ef66f62a4dd4583413606b6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13857 2580 bytes
font_04_sfnt_off000143a2.bin
599d42a1ae1c5543f11f213d20add0cfcc3cd2b2886bfb049ec831c92fd94b4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x143A2 7188 bytes
font_05_sfnt_off00015755.bin
dfa3712ee8c11d7316f04a2df0b709886a159ade7cf7f6f99cfe521389755a22		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15755 19460 bytes
font_07_sfnt_off0001bd0f.bin
d6d4b6f1b7f352d432267b4f0e1a3b962fa55fceade102acb1249ce1b722a51a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BD0F 2832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.