Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3e6f4274e0c1cea…

MALICIOUS

PDF

41.7 KB Created: 2020-11-09 16:47:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 7b046e43dac31d37598d3d71b18da647 SHA-1: eb4dfa75dec525dbaaae6ac60864faeb782033dd SHA-256: d3e6f4274e0c1cea8cf1654c844f7e8c0ceb22cfec99ad1c7627778fece43f62
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a lure related to 'activation code for windows vista' and embeds numerous external links, suggesting a link farm or SEO poisoning tactic. The primary malicious URL identified is https://trafficel.ru/strik?keyword=activation+code+for+windows+vista, which is likely used to redirect users to a malicious site. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?keyword=activation+code+for+windows+vista PDF link annotation
    • https://suzulazupe.weebly.com/uploads/1/3/3/9/133997697/wugipegexajiwej_wilibigoxibasu_xojujoxoniz_suzaniwuleg.pdfIn PDF document text
    • https://vumuzasal.weebly.com/uploads/1/3/4/5/134586685/nowapupidomimo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fapaga/pj_daycare_the_movie.pdfIn PDF document text
    • https://s3.amazonaws.com/rokuwapesu/49831305895.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/wexofokotilaki.pdfIn PDF document text
    • https://s3.amazonaws.com/palevijuj/setesomisariza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/912d5781-e159-493f-b491-cfe923c78711/soccer_player_nutrition_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37a129b9-7cc2-4211-bc61-136f95a80d15/39639085117.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92c3caf7-e154-4dde-8d68-36ad339c8c06/siturotutisizelirexenowen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/736ca1da-1225-4b63-8550-27d091517168/movunosijixetowin.pdfIn PDF document text
    • https://s3.amazonaws.com/vavebufevodutob/vezogekusulegukinibiruxuz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/881cbadf-66ae-45d4-8bec-2ae346c9cad3/62263648070.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e247ccf-bbcc-453b-8baa-cf5790b97f18/matovedoliledad.pdfIn PDF document text
    • https://s3.amazonaws.com/guxosa/adding_fractions_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/henghuili-files/sandy_cheeks_spongebob_movie.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65F5 5124 bytes
SHA-256: 67d07c15343435e5856e0a4ece320156d7b829e351617daca7ff381594751fb3
font_01_sfnt_off00007791.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7791 10280 bytes
SHA-256: f164dbbd02493c9c6f117a1d397c485411ecae4c619a5e355f144614539dcc5a

Open this report in the interactive analyzer, or submit your own file for analysis.