Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7e846cb09a0770d…

MALICIOUS

PDF

77.2 KB Created: 2020-12-24 06:42:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 180201c45a92acb23d1c62d4ece862e7 SHA-1: db01cb4fde69e9c4a78cc3b93193fce8fe54785f SHA-256: f7e846cb09a0770db066ae8c543432c4803e38a17c933b266851b275149ef032
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The PDF contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or redirection mechanism. The primary URL identified is 'https://traffset.ru/aws?utm_term=the+internet+archive+website+movie', which is likely part of a phishing or SEO manipulation scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/aws?utm_term=the+internet+archive+website+movie
    • https://rumikupim.weebly.com/uploads/1/3/5/3/135310872/jukufiluvorogakagega.pdf
    • https://fevijalefo.weebly.com/uploads/1/3/4/3/134383315/gabegepupenasup.pdf
    • https://luxufaxunixepu.weebly.com/uploads/1/3/4/5/134584211/8207161.pdf
    • https://sijudunewofas.weebly.com/uploads/1/3/4/6/134696620/lijalepogipami.pdf
    • https://zunivagakasati.weebly.com/uploads/1/3/4/3/134340202/runowadop_nokatekuw_dizamowomuru_zimujarebif.pdf
    • https://cdn.sqhk.co/xezojutatow/eCichhm/modern_day_arcade_cabinet.pdf
    • https://pugiputofal.weebly.com/uploads/1/3/4/7/134740318/c44614.pdf
    • https://cdn.sqhk.co/likafupat/R2qqnoC/suguweku.pdf
    • https://cdn.sqhk.co/merodobiweve/fzjhhaw/73201415071.pdf
    • https://livozuduk.weebly.com/uploads/1/3/4/5/134583284/bigokajune_balabazotek_wozorasudof.pdf
    • https://cdn.sqhk.co/dupeguwova/jjehX9h/etisalat_business_app.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/pozokimepe/66206365553.pdf
    • https://s3.amazonaws.com/vekodupiwarobi/46658290353.pdf
    • https://uploads.strikinglycdn.com/files/655586ed-4010-43fc-a984-0c1f4f841200/biological_science_freeman_6th_edition_study_guide.pdf
    • https://uploads.strikinglycdn.com/files/a0301869-a0ed-4ac2-8054-6dafa96f53fb/tuckahoe_middle_school_covid_testing.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e44c.bin
a702b3cb5f885721823572eee56bfbfbc952fb3c6f98f75f2e8da4ce9641e8e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE44C 5036 bytes
font_01_sfnt_off0000f53e.bin
fb1407cf9c711870502520c88cb079ee1ab5c897a2292472e4a388a60dc277dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF53E 10816 bytes
font_02_sfnt_off0001199d.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1199D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.