Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc03d668179d374e…

MALICIOUS

PDF

93.4 KB Created: 2020-12-18 05:41:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 185a30c97da15bcdb57216b646d97ada SHA-1: d0e288fb615e266fbc0342f9006129ca57b5ec4d SHA-256: fc03d668179d374e49403ccc39b6783b2b87dfd48a4cd26e5cd337870e2972b2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, with one critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. The primary malicious URL identified is 'https://traffnew.ru/strik?utm_term=kasam+12+january+2017+badtameez+dil'. ClamAV also detected the file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0', indicating a phishing or trojanized document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=kasam+12+january+2017+badtameez+dil
    • https://repotadidutu.weebly.com/uploads/1/3/4/3/134310826/485ef8334.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/0ceec98a-0132-43d4-b379-8d3a3742fa47/6332661807.pdf
    • https://uploads.strikinglycdn.com/files/98da44b1-4b2b-4cac-82fe-ccf906706dca/tascam_tsr_8_manual.pdf
    • https://static1.squarespace.com/static/5fc787cf81fec0096842b2a2/t/5fcd581c05ddc9599d322682/1607292957655/metal_shredder_machine_for_sale.pdf
    • https://static1.squarespace.com/static/5fc0b5bec30a162e0c519083/t/5fc2521fa97599144e42f66e/1606570528477/75496325291.pdf
    • https://static1.squarespace.com/static/5fc548af9955c744b5585162/t/5fd10bddb95a9c4104f0d6c1/1607535582041/namolibamajituposebe.pdf
    • https://uploads.strikinglycdn.com/files/43743d39-1b0d-4e8d-9230-9183c579ca63/barosemepiwuxagevim.pdf
    • https://uploads.strikinglycdn.com/files/86417920-e6b0-4537-85ca-56c42de9a70b/repeated_measures_anova_spss.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe00a0bc819f1cf49eff35/1606287521348/36958626985.pdf
    • https://static1.squarespace.com/static/5fc0cc948139af037644bbed/t/5fc181667acac6192af9d0d2/1606517094591/on_the_reproduction_of_capitalism_ideology_and_ideological_state_apparatuses.pdf
    • https://uploads.strikinglycdn.com/files/8c2c63c1-b930-4fff-9c87-f5b280a462ef/sikazadiparoginexotuwal.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe06a5bc819f1cf49f784c/1606289066119/kakosoruluvifivivikotogik.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000121f1.bin
fb622e161708f6e0739be7e0b9a6d8120e4d171655b28eaab70267e8f8858d71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x121F1 5716 bytes
font_01_sfnt_off00013571.bin
c7ae51b3faa7d1c092c2f74fb028e250c11144cd0d9382b74d468e9209c4f886		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13571 12380 bytes
font_02_sfnt_off00015dca.bin
ad8edac1d16c9fbcc900d190a3a3d6efd899429305bf878bb9542032bbe07fcc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15DCA 2568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.