Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf99a6c057f59a40…

MALICIOUS

PDF

66.8 KB Created: 2020-12-09 05:51:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a70688a8e3c047770ba118ff3e59510e SHA-1: 171a9d1ed206bf585e3cfbbe5050efcd57c359d9 SHA-256: bf99a6c057f59a40aebcce6acd6c03fa66cc4bc9ddce726cc83b78c94834a179
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by multiple heuristics and a machine learning classifier, including detections for malicious redirector links and a link farm. The embedded links, such as 'https://cctraff.ru/strik?utm_term=how+to+get+ex+raid+pass+in+singapore', likely lead to phishing or malware distribution sites. The document's structure suggests it's designed to host a large number of outbound links, a common tactic for SEO poisoning or redirecting users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=how+to+get+ex+raid+pass+in+singapore
    • https://bupizezar.weebly.com/uploads/1/3/4/8/134853483/tabifebogelevokewuno.pdf
    • https://sodapovi.weebly.com/uploads/1/3/4/4/134494820/megupupuvelubi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6de95b4f-288a-4dd6-a3cc-feb66e59f8ed/turaviginorikuduzisipen.pdf
    • https://uploads.strikinglycdn.com/files/393d6062-538d-4650-b10d-16db6d405f53/atlas_reactor_reddit.pdf
    • https://uploads.strikinglycdn.com/files/1feb3599-55af-4f07-92ee-1d08dd7f641e/dobumigo.pdf
    • https://uploads.strikinglycdn.com/files/0efd992f-966c-4bcd-b073-57e34f3a6e53/codigos_de_steam_gratis_2017.pdf
    • https://static1.squarespace.com/static/5fc0c24392c50b1a1e76d225/t/5fc281763c02f22b9d5deda3/1606582647021/santa_cruz_flats_az.pdf
    • https://uploads.strikinglycdn.com/files/feadba88-b9e6-43e3-a82f-1fd3917d2699/lowajeneramolejadip.pdf
    • https://uploads.strikinglycdn.com/files/47ad74e8-894a-44a9-8c08-e0366840b55d/toward_a_psychology_of_being_maslow.pdf
    • https://uploads.strikinglycdn.com/files/bf897324-1827-431c-a293-1d1a0e208e47/kenorunufijisapu.pdf
    • https://uploads.strikinglycdn.com/files/281052e9-0ec8-4f79-baa8-63367f3a2e70/wekopa.pdf
    • https://uploads.strikinglycdn.com/files/f27e0d63-de85-4b98-82c3-3b5d6ea24531/66380899228.pdf
    • https://static1.squarespace.com/static/5fc34985239b07229140aab6/t/5fc96a74fbf8976b723ac300/1607035522332/72114290042.pdf
    • https://uploads.strikinglycdn.com/files/ce627ad3-4932-4cf5-b8fd-0b94117f46fc/is_the_sun_a_red_giant.pdf
    • https://uploads.strikinglycdn.com/files/6bcf5865-7644-4a90-8921-ddf1887cf505/60239590904.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c8ce.bin
73db5848f1238b11fc6767f41fa9388ca48160c88725d057a7643631f78c91b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC8CE 5216 bytes
font_01_sfnt_off0000dab2.bin
955a6b7184205bedbdcf339042db6edf721c36f7ed8fee893684b3da8bb18d0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDAB2 10572 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.