Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd2b515ee749acc0…

MALICIOUS

PDF

72.7 KB Created: 2020-12-28 22:40:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 23d9c47a19a1e3e4bd108461e4105385 SHA-1: 7b2c77da5c49eab61e86e3c5b5ffcd0637e22b67 SHA-256: fd2b515ee749acc0d8a9a4880bec214f2b2d48a2b3ccfeb6c5eae54dac8e768e
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links, many of which point to disposable hosting services and redirectors. The primary redirector URL, 'https://traffmen.ru/strik?utm_term=hmrc+self+assessment+income+support', suggests a phishing lure related to tax self-assessment. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/strik?utm_term=hmrc+self+assessment+income+support
    • https://wabebapag.weebly.com/uploads/1/3/4/3/134335427/bolinukekuvokug_nigeresarowunuz.pdf
    • https://xevibobi.weebly.com/uploads/1/3/4/6/134683071/5a7b62ccd1d4211.pdf
    • https://tovozilulu.weebly.com/uploads/1/3/0/8/130873983/9799733cc743.pdf
    • https://riwusivi.weebly.com/uploads/1/3/4/9/134900433/2787e46f00701.pdf
    • https://cdn.sqhk.co/nabixisaf/jigghey/happy_tower_online.pdf
    • https://dovedesomubax.weebly.com/uploads/1/3/4/4/134487211/senit.pdf
    • https://zelapagetuwuj.weebly.com/uploads/1/3/1/4/131406140/c85f0cbef.pdf
    • https://judozolu.weebly.com/uploads/1/3/1/4/131407514/xupowezurupeti.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/fomaralunex/fejijimuxamoj.pdf
    • https://uploads.strikinglycdn.com/files/49444be8-d984-486a-90e2-48974189d655/66506310647.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2f3.bin
1cfd1b2f6bd5109f18b809467d1a4e564b57eb2859e2bbbacc25e4f7bf94d18e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2F3 5004 bytes
font_01_sfnt_off0000e3cf.bin
fba62a8a7629aedfd32fdd5563e66ad43e4926c0ee690668d387bf955307e2a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3CF 10608 bytes
font_02_sfnt_off00010828.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10828 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.