Malicious PDF — malware analysis report

Static analysis result for SHA-256 efd649f9e82ae280…

MALICIOUS

PDF

76.5 KB Created: 2020-12-27 12:15:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 7ff1088ae0a83b1ced7767b751d8d1ef SHA-1: 85524dd4d8392c0ae9f05cda78928b673b4ea11b SHA-256: efd649f9e82ae280c16069e94fd7ed8b001107197d20a421788b38c2bbcf977a
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains multiple embedded links, with a critical heuristic firing indicating it redirects to known malicious infrastructure. The ML classifier also strongly flagged this file as malicious. The document body, though heavily obfuscated, appears to contain text related to 'keyboard themes', likely a lure to entice clicks on the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=red+blue+classic+keyboard+themes In PDF document text
    • https://nilesezijifata.weebly.com/uploads/1/3/4/8/134885493/850623.pdfIn PDF document text
    • https://ropejanetim.weebly.com/uploads/1/3/4/6/134600341/9571267.pdfIn PDF document text
    • https://dapijapivabug.weebly.com/uploads/1/3/4/3/134338952/512905.pdfIn PDF document text
    • https://viwizabodug.weebly.com/uploads/1/3/4/5/134509287/3223366.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371248/normal_5f9572b9b15fd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/polojuliragam/tagenalaxufemubagefufifu.pdfIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/ganepuvujawul.pdfIn PDF document text
    • https://s3.amazonaws.com/xuxifuzituwu/bibia_be_ye_ye_free.pdfIn PDF document text
    • https://s3.amazonaws.com/setikizo/zebesidotolovez.pdfIn PDF document text
    • https://s3.amazonaws.com/nuxulikiwab/maa_tv_channel_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c9a0b33-a01e-4e1e-834e-03735f47bde9/fozuzinipomewilurexi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abb88ae3-9fd6-4f5e-ad30-6f699827ea2a/sowozopifikexuxavozitorub.pdfIn PDF document text
    • https://s3.amazonaws.com/wutezigojuxi/mega_man_x4_weakness_chart.pdfIn PDF document text
    • https://s3.amazonaws.com/lejivugeleguwod/raleigh_redux_ie.pdfIn PDF document text
    • https://s3.amazonaws.com/wumodukubaru/dusazu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c79c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC79C 5492 bytes
SHA-256: 2824ca47fb9a0b327c25bb63de2f593d7534e467869eace713063f9c3b88bc22
font_01_sfnt_off0000da1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA1B 3152 bytes
SHA-256: 4de4c49e1e3b38aa89657956a6f09e7fc272af3dcedc884a3cd1ce9eec73c7a7
font_02_sfnt_off0000e6db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6DB 10852 bytes
SHA-256: 40f915d8ba53b1193313e3bba8a3176f2d7a215b0b7ad0889ad6b2b149e7efb8
font_03_sfnt_off00010c3c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C3C 16600 bytes
SHA-256: c1ff41530661627d2dbbdb97d512e0c07c07a1a461db48abe83e3379e3d83481

Open this report in the interactive analyzer, or submit your own file for analysis.