Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed3cdbb49a0811a9…

MALICIOUS

PDF

110.9 KB Created: 2020-11-24 14:48:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: 92b7e62144a6157ba1bc80df0e11f035 SHA-1: 71c0ca443fa7e21e71d4cbf627e2c7019d6f5bce SHA-256: ed3cdbb49a0811a951add141d482a2c3d7bb5eb786e53ca6751d69be7b2cb9ed
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to PDFs hosted on various platforms, suggesting a link farm or SEO manipulation tactic. The primary malicious URL identified is traffnew.ru, which is likely used to host or redirect to malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=clasificacion+de+software+libre PDF link annotation
    • https://wosowabo.weebly.com/uploads/1/3/4/3/134340570/9837910.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416513/normal_5f967963a996e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446045/normal_5f9e5cf699228.pdfIn PDF document text
    • https://vabekozel.weebly.com/uploads/1/3/4/4/134487462/6950310.pdfIn PDF document text
    • https://vozunutav.weebly.com/uploads/1/3/0/9/130969695/kodamolasamim_sogotesexisalav_gizuwewiv_kedewifofazi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374013/normal_5f9542cac0d54.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367303/normal_5f89495ee3c58.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410433/normal_5fa6746ad470b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/52624c51-e952-47b1-8ea8-cd8af800f8e0/heroes_of_olympus_book_5_free_do.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/828c40e6-102d-45ae-8381-388c489ada69/9958962398.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/698f9738-095f-4105-9f90-421dda726fd5/xulivolodipubab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32b0e86c-642b-4670-b333-639d83f1f1ce/29441033475.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00017fdd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x17FDD 25952 bytes
SHA-256: d6b0618f7511da5e538e83d52fec804089ae8d5ee46a2861fade7ce3dbe88ac2
font_00_sfnt_off00014507.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14507 5152 bytes
SHA-256: c4e3f9a9d8af56fa33c6f33fe8aa5a69861c3167a6d10c8831f736fa7a097af3
font_01_sfnt_off000156ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x156AB 12532 bytes
SHA-256: b7f982bf4378ae8f5515ca70b2ce01d1f50aa03950541fb22de774f01e466d53

Open this report in the interactive analyzer, or submit your own file for analysis.