Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc8ea94b8576d43d…

MALICIOUS

PDF

58.1 KB Created: 2020-11-20 04:21:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1d05d79490bc7e2f69b99c643b772080 SHA-1: dff102762db223d74ab02baa43e4e39ad0c90f62 SHA-256: fc8ea94b8576d43d2e4f021fd60943e4348bef440e8a46e46c89cb884fb72606
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by multiple heuristics and a machine learning classifier, specifically flagging it as a redirector and a link farm. It contains numerous embedded URLs pointing to external PDF documents, suggesting a phishing or malware distribution scheme. The presence of a link to known malicious infrastructure further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?utm_term=dead+set+crossword+answer
    • https://detopeda.weebly.com/uploads/1/3/4/3/134305225/0fb4e.pdf
    • https://kimumowo.weebly.com/uploads/1/3/4/4/134480515/9243451.pdf
    • https://rikisuluwujufa.weebly.com/uploads/1/3/1/4/131452938/pemela-gilipegamelanil.pdf
    • https://jikevumuvovidu.weebly.com/uploads/1/3/4/3/134324483/4364389.pdf
    • https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/bigunurusipota_vovavubavuw_malolipesafa.pdf
    • https://cdn-cms.f-static.net/uploads/4367019/normal_5f877182b25a3.pdf
    • https://xizejaselaz.weebly.com/uploads/1/3/4/3/134357450/86832641d85.pdf
    • https://jezulusawuse.weebly.com/uploads/1/3/4/0/134000263/ba9497a70.pdf
    • https://cdn-cms.f-static.net/uploads/4373757/normal_5f8cc93b45ba4.pdf
    • https://vozapevozatoka.weebly.com/uploads/1/3/4/0/134097066/tetik.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/36981798-3862-43cb-a7a9-cf6ee184f37d/natiruts_reggae_power.pdf
    • https://s3.amazonaws.com/kisimujuk/titiwop.pdf
    • https://uploads.strikinglycdn.com/files/87d66888-5f7e-4db0-a600-48a0b8fef6c5/13044867477.pdf
    • https://uploads.strikinglycdn.com/files/f24fca0a-be74-4b0a-8360-020cec872e03/24399818980.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aa33.bin
c145858634cf56a36f95359d0b8cd1451d879ee15fdb8ab757ea6e9e9ef74a21		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAA33 4992 bytes
font_01_sfnt_off0000bb54.bin
84a37da128dc2130096923e203cea1509f1961595ea6ebd2c7dd26dbe0b30eab		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBB54 9484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.