Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2f560f4bc83a247…

MALICIOUS

PDF

72.1 KB Created: 2020-11-24 20:58:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: be7c854a99c4657ab05a9b600f63a10e SHA-1: d7a582a85525521452230d9768ef0ff612e6640a SHA-256: d2f560f4bc83a2471ac4cfd3f7e8bcac1bde67ef95a2cc9c6a1f921e714862ba
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying a 'PDF link farm' pointing to multiple PDF files. One of the primary URLs, 'https://traffnew.ru/123?utm_term=new+jersey+law+firm+salaries', suggests a lure related to salary information. The presence of ClamAV and ML detection further supports its malicious nature, likely as a phishing or malware distribution document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=new+jersey+law+firm+salaries
    • https://vewusijonaw.weebly.com/uploads/1/3/4/4/134489037/xawavaj.pdf
    • https://cdn-cms.f-static.net/uploads/4388406/normal_5fad5deef1f82.pdf
    • https://gujodoludota.weebly.com/uploads/1/3/2/6/132681740/2696375.pdf
    • https://cdn-cms.f-static.net/uploads/4374857/normal_5f897b5e27748.pdf
    • https://cdn-cms.f-static.net/uploads/4366313/normal_5f8714a9c8266.pdf
    • https://cdn-cms.f-static.net/uploads/4413697/normal_5fa7901c64a64.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/86b22a32-a017-4033-94b0-fbd9da6e61d6/89511976544.pdf
    • https://uploads.strikinglycdn.com/files/f6f4eacb-2702-4732-94fb-0b91a20ea773/59811541507.pdf
    • https://uploads.strikinglycdn.com/files/955423f1-f562-40b2-8cb8-ca296ce6e473/easybib_apa_format_citation.pdf
    • https://s3.amazonaws.com/lanowilovuviwib/whatsapp_for_redmi_note_5.pdf
    • https://uploads.strikinglycdn.com/files/9c0a0b77-cbd3-4801-9e27-8510f5860421/xorasumu.pdf
    • https://s3.amazonaws.com/megelugik/nez_perce_tribe_clothes.pdf
    • https://uploads.strikinglycdn.com/files/db2cb1ab-3c97-44b0-8df5-edf914115647/flight_stability_and_automatic_contr.pdf
    • https://uploads.strikinglycdn.com/files/176d74b1-438c-4370-a610-a3a9992cc68b/45474832488.pdf
    • https://uploads.strikinglycdn.com/files/2352aba5-ede0-4434-95e0-69fbf16b6a2e/saudi_student_portal.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0da.bin
f23737b9f8bca5d41b626d4a2e70069131f76f7e93a931f450f15aa2f1515c03		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD0DA 4644 bytes
font_01_sfnt_off0000e0b5.bin
7ef4b9f7044e6f33f918cf28a8d9eebe6ac59774ce0a5220875ac5a7e25d18a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE0B5 10640 bytes
font_02_sfnt_off0001051f.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1051F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.