Malicious PDF — malware analysis report

Static analysis result for SHA-256 d008acd0a448345b…

MALICIOUS

PDF

78.8 KB Created: 2020-11-10 12:02:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ca454fc826562c3a6cf18516d72323a1 SHA-1: d669ad854b52c95080376d647f952793f4bc0dab SHA-256: d008acd0a448345b45dcc77a56577d4856fe886aedd89a00063214dbb1e5c916
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting a phishing or malware distribution attempt. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the presence of embedded URLs and the overall structure point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?keyword=acer+aspire+repair+manual
    • https://kuvofexe.weebly.com/uploads/1/3/1/1/131163751/gojali_zexil_luxof_karosininu.pdf
    • https://kedasawavofari.weebly.com/uploads/1/3/4/5/134589708/bokizezivun.pdf
    • https://xelenupexom.weebly.com/uploads/1/3/4/4/134480667/e9874f4b.pdf
    • https://rulomegujenuguv.weebly.com/uploads/1/3/4/3/134329868/514fd12f43ec.pdf
    • https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/c8b1591a53e55.pdf
    • https://cdn-cms.f-static.net/uploads/4385230/normal_5f91129e81f32.pdf
    • https://cdn-cms.f-static.net/uploads/4425924/normal_5fa7e129b91ae.pdf
    • https://fejisamuzek.weebly.com/uploads/1/3/4/6/134636520/vezixapizumukuz.pdf
    • https://wopusuxosar.weebly.com/uploads/1/3/4/5/134583764/powuvavozog.pdf
    • https://ridogorizaloliv.weebly.com/uploads/1/3/4/5/134527302/3a483bc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/390b48d9-b87b-4fd1-a7ec-dd8a38f04fca/zavegesewomokexoketapa.pdf
    • https://uploads.strikinglycdn.com/files/dce9a24f-6994-4472-aa4c-45ebb53ba2b9/gimapirusotezokom.pdf
    • https://uploads.strikinglycdn.com/files/ddfeae31-e293-451d-af45-7ceb7bb884f7/lutez.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000108d6.bin
c1c303a7c832743561fe65158ba2abd2ad91cea346312e96b1cf985a4e3f8c34		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x108D6 22280 bytes
font_00_sfnt_off0000cf1a.bin
cbd1c78810fd126b240e7910b61ea62d6eb8f1b8c818c72e37d45b5fcde38842		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF1A 5068 bytes
font_01_sfnt_off0000e041.bin
d71facf1e08abaa5f0e1551e76d9926ba9693ed059f525b343079f629285fd35		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE041 12424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.