Malicious PDF — malware analysis report

Static analysis result for SHA-256 f77f8373a3d0692d…

MALICIOUS

PDF

69.3 KB Created: 2020-11-20 07:46:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: dcb4c73fcb0e173925f7a73abf8b95f9 SHA-1: 19b13f48564402ddcc69dd927b5c783c2fec3c68 SHA-256: f77f8373a3d0692d5128bb6483a2b6b1d64e2bc0943820a2d269896dcbd9ed66
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. It contains a large number of external links, suggesting a link farm or redirection mechanism. The document body, though heavily obfuscated, contains references to 'Facebook profile template 2018' and appears to be generated by wkhtmltopdf, which is often used to create documents for phishing or spam campaigns. The presence of numerous external PDF links further supports a malicious lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=facebook+profile+template+2018 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4366022/normal_5f961d92cf26d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381082/normal_5fa38e6746b61.pdfIn PDF document text
    • https://pegepigav.weebly.com/uploads/1/3/4/4/134481067/f1013123.pdfIn PDF document text
    • https://rotutokobuzafoj.weebly.com/uploads/1/3/4/4/134455929/13971.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391327/normal_5f90d64cb3af9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382201/normal_5f992bea1bead.pdfIn PDF document text
    • https://folesatabija.weebly.com/uploads/1/3/4/4/134441350/mutenilimofokapa.pdfIn PDF document text
    • https://wuwifure.weebly.com/uploads/1/3/4/6/134647121/mesufajebaris.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/797a2c3d-9a06-43c2-bc0f-88311507cd18/brian_tracy_eat_that_frog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eee9209e-9612-4d84-8944-20e3dd2eff3d/80468062637.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11fd90d5-8ebb-4500-916a-c3765c709ce3/bixorenixoxemosedadi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76f1592d-7d26-42a1-9912-8b0da7e7959b/1284434285.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d195.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD195 5660 bytes
SHA-256: e07a19cf21f1524d349fb4ceb7ab14804aa46cadefd737422f037664a6c89db4
font_01_sfnt_off0000e4c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4C8 10496 bytes
SHA-256: c2ceaa100677a08f5f9e16210b26c5f4351e6a0d70f69bdae23e44721f5ccfb8

Open this report in the interactive analyzer, or submit your own file for analysis.