Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3647a51a5b81491…

MALICIOUS

PDF

77.0 KB Created: 2020-12-18 13:05:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b143ac295b6db8097cc0eb48e4293f45 SHA-1: 17089a7e710c4960c9158064903f3db4c1bf0a44 SHA-256: c3647a51a5b81491645f7682f6a7dc4461363670633b99a7d3fbd8984f6074f1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it functions as a link farm or redirection mechanism to potentially malicious websites. The document body, though heavily obfuscated, contains keywords related to 'Bunn my cafe mcu replacement parts', likely used as a lure to attract victims.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=bunn+my+cafe+mcu+replacement+parts
    • https://zesopupejilit.weebly.com/uploads/1/3/0/7/130738861/puzasi-giwowovejuw-rifomigan-sawupikupamod.pdf
    • https://bevabuje.weebly.com/uploads/1/3/4/8/134897483/4850c0f40.pdf
    • https://bakubirusi.weebly.com/uploads/1/3/4/6/134680497/8c369cbfd196f6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcfa6dedabee7b44073cef/1606220400357/coloring_dna_worksheet_answers.pdf
    • https://uploads.strikinglycdn.com/files/bf052995-7fcf-45ec-97a1-a75d52d75288/florida_gulf_coast_triathlon.pdf
    • https://uploads.strikinglycdn.com/files/3352f1d1-4204-4d0f-93c4-b8fa540574df/9720128533.pdf
    • https://static1.squarespace.com/static/5fc1380dc6d9645836244656/t/5fc85236094cf7617dbd1fbe/1606963767290/virus_war_mod_apk_1._6._3_download.pdf
    • https://static1.squarespace.com/static/5fc648058ef7301f8b35a0c6/t/5fcee3ee0ff3944fc54b8e49/1607394287324/47877601614.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcfc222edfcd2bda917420/1606220839015/endless_frontier_hack_version.pdf
    • https://uploads.strikinglycdn.com/files/42b437be-b5da-4f76-a107-e6c1135ffd90/the_ideal_team_player_download.pdf
    • https://s3.amazonaws.com/zufaxepixiguxax/stato_aeriforme_o_gassoso.pdf
    • https://s3.amazonaws.com/zuwosil/nepuxubutukepivukafivika.pdf
    • https://static1.squarespace.com/static/5fc77f6f579eee3ae06e1abd/t/5fd1ecb8071bbc68802dc8bb/1607593147948/rilax.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf64.bin
0aa924e648a0284fd75065f7387bb4e8444f50f6085d8cf7007504a4578b073e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF64 5312 bytes
font_01_sfnt_off0000e167.bin
b90b2aaf1651e0e013876bfd3eb4a2880a6efce71bd85ab6b66a774fd7a548e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE167 15344 bytes
font_02_sfnt_off00011166.bin
0318b400cbd4eb80818b7eb131bcca2e18f343f850c5eb1573e525fea31f4d56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11166 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.