Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7a89810bd16f4a7…

MALICIOUS

PDF

69.5 KB Created: 2020-11-11 08:11:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: e63301e51e5f4a8c33395e61846ffcd7 SHA-1: 750d4ea12b9dd5dce9f1fcccb50348435e1a566d SHA-256: e7a89810bd16f4a705ba0af7e13d6d9516f81d184ac06762da481d08fbdd851f
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, with a critical heuristic indicating a 'PDF_SEO_LINK_FARM'. One of the primary URLs, 'https://trafftec.ru/strik?keyword=algia+definition+suffix+medical+term', is suspicious. ClamAV also detected the file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0', suggesting a phishing or trojanized document. No scripts were extracted, but the overall structure points to a malicious document designed to redirect users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?keyword=algia+definition+suffix+medical+term PDF link annotation
    • https://dejolezeg.weebly.com/uploads/1/3/2/8/132815968/bixofivaja.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366036/normal_5f99db6bcfcca.pdfIn PDF document text
    • https://nukevokisoget.weebly.com/uploads/1/3/2/7/132711970/regamafizesoxidiwed.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/risisipajole/duvobaluf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b944577-2208-4f9b-9d2e-3371ee4fd6a5/dugerubavaxupa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c926c07f-23c6-43d9-b2bd-286618c8eb8f/bijidadeselulugewevoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd8558ed-bf27-42ed-b2ad-c93d99afc23b/4434475170.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23eff8c8-cf84-4db7-b5c5-fb7119718bfa/gopro_hero_7_user_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/zaxuledo/71296359571.pdfIn PDF document text
    • https://s3.amazonaws.com/juvetaso/kusuketaribojezogatukew.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0be1ec9-eb7b-49cf-b9c1-e04fd5dd64db/zexujepuzivelufile.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e9b5eb5-a140-4f5b-a60c-06caba2de4e1/white_pine_trail_belmont_to_rockford_mi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c768.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC768 5400 bytes
SHA-256: e9846d541297b9bcd9624642dd600257fb7526d60e7b546e1260334ff0f19ab4
font_01_sfnt_off0000d9af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9AF 1800 bytes
SHA-256: 51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0
font_02_sfnt_off0000e23d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE23D 11448 bytes
SHA-256: d3eb02fff86e721284309770d5a09a8d4d2ef961f1f51e7752927b75d790888c

Open this report in the interactive analyzer, or submit your own file for analysis.