Malicious PDF — malware analysis report

Static analysis result for SHA-256 defb7b354e3eb4bc…

MALICIOUS

PDF

64.0 KB Created: 2020-12-11 13:47:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 5dd2897d818f4432aef0ac4e2bfe7443 SHA-1: d43024e39d22fb90c90ddf3fbb31b75ecb9a6a0d SHA-256: defb7b354e3eb4bcaf1674ab9967e9951e150b7abe1257ea3b7b85b0a682f71b
196 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/aws?utm_term=analog+way+ascender+manual PDF link annotation
    • https://minikugonon.weebly.com/uploads/1/3/4/5/134500064/8099817.pdfIn PDF document text
    • https://rosaguvedofim.weebly.com/uploads/1/3/4/3/134352906/vadivon_danosolunisaluk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/457738d7-2627-4308-8db9-c3b9b5b470db/mirro_matic_pressure_canner_instructions.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc509f16b97992eb5765355/t/5fce0eacc00f007cea0ee80e/1607339697911/537751973.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5b2643dfdd95b60f5e80d/t/5fcfbc8467fa953b722f5be4/1607449733150/super_sniper_game_mod.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5ac2eabaecd331842ccaa/t/5fd1fbd7133bcb3b88a293a1/1607597015414/best_music_videos_2020_billboard.pdfIn PDF document text
    • https://s3.amazonaws.com/jadudusujuje/47548512643.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4d7952cf09257bd84ef09/t/5fc553653c02f22b9dbd0e1d/1606767461572/fairy_tail_episode_1_english_dub_youtube.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc77d6af59f035d0ccd659c/t/5fcc3c09260a660a6bce2be3/1607220237477/lanijetusudijigiketisavuv.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc365b22e34347c70542066/t/5fcc51a1cded405bb8cdccfd/1607225761976/we_cure_incurable.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b95d069-ed40-41c4-b137-4060c9440798/lozifojo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c30b495f-b766-43d6-9361-d3bb323363ee/closer_download_mp3_chainsmokers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fbab6a7-9f2f-4230-bf53-483e97377a79/67582724269.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc512818ef7301f8b2bd9f2/t/5fc5216df3de5e49b509172d/1606754670216/ucf_epc_appointment.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4cd31972c46e3c9512e6/1606372564708/sawojalakigunoleguruv.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1366588c99b6d37a92994/t/5fc447263485235c864e4c5e/1606698791469/warrior_cat_games_untold_tales.pdfIn PDF document text
    • https://s3.amazonaws.com/zusevamasor/69018807333.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1bc471452f90b7feb30c6/t/5fc37a6f4e98326c027dea85/1606646384070/fododediwubijudapova.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bc4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC4C 5444 bytes
SHA-256: a347bcdf4d909e9539b187111f2ce31fc701a172441502d7b83e21d62fb43dfa
font_01_sfnt_off0000cecc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCECC 10596 bytes
SHA-256: 4f76e99ebd04099b24565bc2515789d3d97216098523cf1441aeca7317df925c

Open this report in the interactive analyzer, or submit your own file for analysis.