Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9b64e6c413295c2…

MALICIOUS

PDF

52.6 KB Created: 2020-11-06 19:35:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4681f4e31ca6b90b45e56cd4be86d506 SHA-1: e3e80e259be0375f314ee2dfec9652dfd14204cb SHA-256: d9b64e6c413295c2766dc4d1160eef09ac6121ed7f4d0c65c3e010ff0f3e2f40
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a primary focus on directing users to 'traffking.ru'. The document body, though heavily obfuscated, contains a URL that appears to be a lure for a game mod, suggesting a phishing or scam attempt. The presence of a large number of external links, many pointing to PDF files, indicates a link farm strategy, likely to improve search engine ranking for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?keyword=sonic+adventure+2+mario+mod
    • https://cdn-cms.f-static.net/uploads/4418970/normal_5f985e0d99610.pdf
    • https://kotirilu.weebly.com/uploads/1/3/4/3/134332744/9be7f3e5b.pdf
    • https://julavatevimire.weebly.com/uploads/1/3/4/6/134669339/lifoxefulaga.pdf
    • https://gutomaxitokivi.weebly.com/uploads/1/3/1/3/131383747/3c6768b46b82455.pdf
    • https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/3434266.pdf
    • https://cdn-cms.f-static.net/uploads/4373757/normal_5f8e0b39a27a6.pdf
    • https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/5401885.pdf
    • https://cdn-cms.f-static.net/uploads/4366024/normal_5f88fc7cc6b90.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1ae7bed3-f31d-43b8-a437-8d4442bfeca4/tajalitabosefajunegon.pdf
    • https://bekovepevim.files.wordpress.com/2020/11/vagegegobusebujudujab.pdf
    • https://tegorijike.files.wordpress.com/2020/11/39868530588.pdf
    • https://sisiviweze.files.wordpress.com/2020/11/50939477702.pdf
    • https://lixedot.files.wordpress.com/2020/11/2kids_one_sandbox_original_video.pdf
    • https://rovamidenube.files.wordpress.com/2020/11/manual_de_servicio_toyota_tercel_1993.pdf
    • https://uploads.strikinglycdn.com/files/bc2e3ba0-9d55-4952-ba5b-9359fdd68664/sedojepujopifaweki.pdf
    • https://uploads.strikinglycdn.com/files/92c3caf7-e154-4dde-8d68-36ad339c8c06/siturotutisizelirexenowen.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a188.bin
00fbe44eebc92f8f40857d09ba71466edf5499035b3efdfb1306e1acba106ea3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA188 3404 bytes
font_01_sfnt_off0000adaf.bin
399731b0690bdc31d1eb761b18988170226134a95087b8e045f117b1ccfe55be		 pdf-font-stream PDF embedded font (sfnt) at offset 0xADAF 5052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.