Malicious PDF — malware analysis report

Static analysis result for SHA-256 f1f2fa369ae96e42…

MALICIOUS

PDF

72.7 KB Created: 2020-12-18 12:49:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f211819155859286775193488ad87f40 SHA-1: 5a3c6da03140466ace7a65b96edaf8b3fd9909c6 SHA-256: f1f2fa369ae96e42eaac123672ff0edc57131878f4cb46a12eb890bda85e1d4d
254 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged as malicious by multiple heuristics, including a critical finding for linking to a known malicious redirector. The content and heuristics strongly suggest an advance-fee scam lure. Although no scripts were explicitly extracted, the PDF structure and malicious link indicate an attempt to redirect the user to a malicious site, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/123?utm_term=investment+contract+template+south+africa
    • https://gakuwalexutibok.weebly.com/uploads/1/3/4/3/134332976/xopolenud.pdf
    • https://mebenemezozu.weebly.com/uploads/1/3/4/6/134689881/9f87f9e2d4f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static1.squarespace.com/static/5fc11b4016f6d44b07c000b4/t/5fcc2e4d920f47545b85203d/1607216717650/59278999027.pdf
    • https://static1.squarespace.com/static/5fc0bcfb2e537a05ef083615/t/5fc0fbbb3f75b16643f719ae/1606482876631/micro_and_macro_economics_similarities.pdf
    • https://static1.squarespace.com/static/5fc2b42eab79f442f2353307/t/5fc921fc60973a49d3c1c434/1607016956157/fomir.pdf
    • https://s3.amazonaws.com/wusone/huckleberry_finn_study_guide_answers.pdf
    • https://static1.squarespace.com/static/5fc79f8081da8a590db1a476/t/5fd60cc6c4373837b9015880/1607863495203/classic_shell_windows_xp.pdf
    • https://uploads.strikinglycdn.com/files/392a471c-8c33-44e6-9526-7d370edcec15/side_view_drawing_reference_face.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe1c6fa97599144ec02de4/1606294645332/como_formatar_o_lg_e615f.pdf
    • https://uploads.strikinglycdn.com/files/ee98948e-8895-4498-b8d4-20a3d6438fff/infarctus_de_la_rate.pdf
    • https://uploads.strikinglycdn.com/files/73d2a365-0c9e-4944-bf6c-b54c153465ef/.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf54aa9d79364840850716/1606374571923/morpheus_apk_download.pdf
    • https://uploads.strikinglycdn.com/files/e1611444-9858-46c6-97fb-a84e085c5129/nenegisi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e03b.bin
0280591776ad9ecef0ed294862650edeb095a92e2fbd864f8d100f7e3b6ae54f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE03B 5252 bytes
font_01_sfnt_off0000f1f4.bin
ac03b84be41e55e29bd22d8241450fa014100f500a3f194a96e9e7b995fe2c96		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1F4 10608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.