PDF malware analysis — malicious · d3e38da6b00bb648

MALICIOUS

PDF

65.8 KB Created: 2020-12-20 03:36:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: c32110e24b7ead9e6d658d524922d1a7 SHA-1: e1716e0c43ce91313e85c2464565b8faec8ce8bf SHA-256: d3e38da6b00bb648e03694ee002b8ac76ccc089bd1792818325705c3ff540a17

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as an SEO link farm. One of the primary URLs, 'https://trafffe.ru/strik?utm_term=integer+flash+cards', is flagged as an SEO redirector, suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/strik?utm_term=integer+flash+cards PDF link annotation
- https://kokubexajaluk.weebly.com/uploads/1/3/2/6/132681668/xipufeminitigadikosi.pdfIn PDF document text
- https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/kagejosuwu-bufegolofajog-pujefadu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393638/normal_5fd12f9153de9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381539/normal_5f93be9566f1a.pdfIn PDF document text
- https://werotibumef.weebly.com/uploads/1/3/4/9/134900185/9674953b38e.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/ed5d26e8-cf85-4477-b0fe-40303a5a6881/jadibivuvidedexumabo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3f2cdfb5-926f-4747-aab8-b5e204acc5f5/loxidawuwegolagesonim.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bf6f99da-6934-4245-9eed-ff81e2eb948f/cost_of_living_in_puerto_rico_vs_texas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/60dd45b7-d0cb-4f60-8922-6c96bca74d78/grey_water_tank_valve.pdfIn PDF document text
- https://s3.amazonaws.com/wanasuvedigo/24523621016.pdfIn PDF document text
- https://s3.amazonaws.com/buxoparadazegu/jaliveteripezadorebowe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e1f0e2f4-de21-4f83-8d5b-18ddc8f52693/homeschool_performing_arts_michigan.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/580d6cab-8f6d-42ab-bbd7-8430a2bdad61/22387877897.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9512b657-7ba6-47af-a690-9981689d553a/legiwik.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/07733f1f-34a4-4df5-b3c9-87d36e830255/62706654308.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8cfd0415-200f-4e5a-b5d0-1e3362caef56/the_village_hidden_in_the_leaves_sign.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/47833159-96eb-4fb2-a8d7-a225b17a8b78/platform_toolset_v141_visual_studio_2012.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b9fb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB9FB	4848 bytes
SHA-256: `6b991b32179323a632400237b353dc51560abf51b853c57b61d067ef22e8a552`
`font_01_sfnt_off0000ca5c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCA5C	9904 bytes
SHA-256: `31cff62cb800186481d5c9fcbc2ed09fee48c8cf066b5f19080b86ffd23eaa47`
`font_02_sfnt_off0000ec52.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEC52	4324 bytes
SHA-256: `0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333`

Open this report in the interactive analyzer, or submit your own file for analysis.