Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd29acc482457bc9…

MALICIOUS

PDF

80.6 KB Created: 2020-12-17 21:16:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 5aee7f06bea49e65fc44da7d4d310b71 SHA-1: 6b412b47851c8bd419ab49a609b20fb5589e6c59 SHA-256: cd29acc482457bc9e4ebc4c7f85573c46beb7c10fce5fefa7a0fc3c1ad44e683
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document is designed to host numerous external links, with one identified URL pointing to 'trafffi.ru'. This indicates a potential phishing or malware distribution scheme disguised as an SEO-optimized link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?utm_term=hollywood+f2+over-the-top+2+bike+trunk+rack PDF link annotation
    • https://takewinedol.weebly.com/uploads/1/3/4/7/134768260/sukebad.pdfIn PDF document text
    • https://divowotekek.weebly.com/uploads/1/3/4/7/134759223/02ebd57.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0a553fdc31513a1173eb/1606224473581/52042027950.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc548dcd26ff1194f90dc53/t/5fd6ebc089566e781f634559/1607920581568/67347023291.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00f03dff-168b-4c6a-b029-8210555cbc1b/total_war_3.4.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/155fbb2b-3ccf-4c2a-bee1-2078c0f895de/miracle_on_34th_street_1947_cast.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc50d53c6229360ecc78f6a/t/5fd6792189566e781f52a412/1607891233627/algebra_olympiad_problems.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc14ca588c99b6d37a9dd1a/t/5fcc1498662d5e24e0905361/1607210137949/jilet.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc283f51c8c7413143c2872/t/5fc48984fa04221c71b0dba5/1606715783955/3137212776.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/07e44c26-7a4d-4bae-ac0a-33a05d728cf7/tony_story_leslie_marmon_silko_analysis.pdfIn PDF document text
    • https://s3.amazonaws.com/fasanag/10123270174.pdfIn PDF document text
    • https://s3.amazonaws.com/zakunafu/bitbucket_api_repo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce2447ea95a9497c0510bc/t/5fd68d8e491a58544a186940/1607896462971/14267838813.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce6b3bc6682d375c9096f4/t/5fd171e0071bbc68801f24f6/1607561697671/bosukonudonifijijusoxe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE6B 5648 bytes
SHA-256: 84e46768ace6eee8e679041eafd73ecdbd775b4efafc1331b6cfb25dd645cf44
font_01_sfnt_off000111c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111C3 10460 bytes
SHA-256: ba1331decfc336462695900ab12e495313e614a2847e445d5ad1315dfe96c452

Open this report in the interactive analyzer, or submit your own file for analysis.