Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7e2783805ee5ae3…

MALICIOUS

PDF

82.8 KB Created: 2021-01-10 11:33:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: e61182b2610760fd25aa947a9964b420 SHA-1: 6ba24892202c5fb06e0481041c24f8c8e389e4c9 SHA-256: c7e2783805ee5ae3aa8f9a19cd3b1ac88605c0e34c5e5c3bb4fc93d1ad0afe42
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to external PDF files hosted on various domains, indicative of a link farm. One critical heuristic identified a link to known malicious redirector infrastructure. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or SEO manipulation to drive traffic to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/wb?keyword=metta%20world%20peace%20twitter%20video In PDF document text
    • https://cdn.sqhk.co/kiraxozi/giiiaaY/pencil_skirt_outfit_ideas.pdfIn PDF document text
    • https://cdn.sqhk.co/libibajuzumu/fsigOig/nunipojededevebuw.pdfIn PDF document text
    • https://cdn.sqhk.co/zivudasexoni/OJdaqja/5447131272.pdfIn PDF document text
    • https://varusimutajol.weebly.com/uploads/1/3/4/5/134502614/5897634.pdfIn PDF document text
    • https://cdn.sqhk.co/jerowerar/jh2jaNa/zuzaxipurozed.pdfIn PDF document text
    • https://cdn.sqhk.co/pododefakes/ct1Lbjh/funny_soundboard_sounds_download.pdfIn PDF document text
    • https://cdn.sqhk.co/vatuliwa/ggWzdSq/19048951631.pdfIn PDF document text
    • https://tejubodefi.weebly.com/uploads/1/3/4/3/134351051/3443906.pdfIn PDF document text
    • https://cdn.sqhk.co/mujexoxa/flk6jbu/checklist_for_task_list.pdfIn PDF document text
    • https://cdn.sqhk.co/lidupusumoj/gege4jf/us_army_air_defense_command_patch.pdfIn PDF document text
    • https://radisowe.weebly.com/uploads/1/3/4/3/134366404/225270.pdfIn PDF document text
    • https://site-1177067.mozfiles.com/files/1177067/comprehension_questions_and_answers_for_the_giver.pdfIn PDF document text
    • https://cdn.sqhk.co/lazogapuvo/Iigfrhf/83823327477.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xeroguru/outlook_computer_login.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8DC 3804 bytes
SHA-256: e843e51503a61cd7208cd56cc1d210cfcfbdccde22072f6aa0129665aa6d45c3
font_01_sfnt_off0001065b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1065B 5048 bytes
SHA-256: a7d2fb9e071c8fd99aef0bc8c8c813c0e3152db0ded466b67d354f1c141c0f71
font_02_sfnt_off000117b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117B9 11244 bytes
SHA-256: 7e58d819f46592fdecd609d2b7f3fd7239b338824da5ed3a136ec67c97659ae0

Open this report in the interactive analyzer, or submit your own file for analysis.