Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc9a67b56d56cb63…

MALICIOUS

PDF

41.1 KB Created: 2020-11-07 00:40:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 90e2b8c95b0dcb3f36c2d39607ca73f7 SHA-1: 08a9da144bf1b1c855b7496b167c8c31699c304f SHA-256: dc9a67b56d56cb638df5031a37b68844dc2187872989dc77d9fdbeb332b4012e
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs and a document body that presents a mathematical expression, likely as a lure. The heuristic 'PDF_SEO_LINK_FARM' indicates the presence of numerous external links, with one pointing to 'wepugimi.weebly.com'. The primary URL 'traffine.ru' is also present in the document body and as an embedded URI. While no scripts were explicitly extracted, the nature of the embedded links and the document's content suggest a phishing or scam attempt, potentially leveraging a client-side exploit or social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?keyword=write+the+expression+in+standard+form+3%252F3-12i PDF link annotation
    • https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/xewonanek.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381098/normal_5f95c2e4c02b3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421341/normal_5fa3144329939.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393626/normal_5f9a08a552d00.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366369/normal_5f88ed99be919.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409992/normal_5f93e4d1a6df0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403565/normal_5f962c0cc4a61.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417830/normal_5f95cbd97f10c.pdfIn PDF document text
    • https://xekexudaxojow.weebly.com/uploads/1/3/4/3/134365032/6c54e.pdfIn PDF document text
    • https://nixejinalir.weebly.com/uploads/1/3/4/3/134321479/tigoluzavodufet.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379474/normal_5f8d231f9239e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369915/normal_5f983bd19bb90.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://dojofenuf.files.wordpress.com/2020/11/xixeludeposixalitikada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1363b801-d0a4-4d81-a040-8e2c6d9f0d83/44826112249.pdfIn PDF document text
    • https://tufebofajo.files.wordpress.com/2020/11/9092157610.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a3d55c6-d250-43ff-8262-e1b7309b64b2/32959903781.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005019.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5019 2888 bytes
SHA-256: 6f2a6df54add4989ddb944bf337afdbe14cfe9709f41fdb3d2996e2e7fab70a8
font_01_sfnt_off00005a5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5A5D 5748 bytes
SHA-256: b9476f092e579fa536440720c1b50690046ea1fa27f6eb09fa359def062bf995
font_02_sfnt_off00006de9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DE9 11388 bytes
SHA-256: 51ca965ea3d5ef21bef5b3f1f10ae9b8a06de2165bb29f2af569edb5ce51b5e3

Open this report in the interactive analyzer, or submit your own file for analysis.