Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd2bdd851edc0a5c…

MALICIOUS

PDF

96.7 KB Created: 2020-11-09 22:25:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c968d16e06cc13547a5f3c84f4d41853 SHA-1: d5885d363ae6d4ffe7d2383e458ca3c116d72c8f SHA-256: fd2bdd851edc0a5c56734205e6eff650da3ad4ddbe7d20d6a9e96def1138cdbe
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The PDF contains a large number of external links, many pointing to PDF files hosted on domains like 'weebly.com' and 'cdn-cms.f-static.net', suggesting a link farm or SEO spam operation. The primary URL, 'https://trafficel.ru/123?keyword=essentials+of+oceanography+by+trujillo+pdf', further supports this, presenting a deceptive search result.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/123?keyword=essentials+of+oceanography+by+trujillo+pdf
    • https://cdn-cms.f-static.net/uploads/4379473/normal_5fa0c356ebbbc.pdf
    • https://cdn-cms.f-static.net/uploads/4410006/normal_5f95a3ee1fabd.pdf
    • https://duxebiforup.weebly.com/uploads/1/3/4/0/134013009/xidapedatevu.pdf
    • https://letateworu.weebly.com/uploads/1/3/4/3/134365764/5745489.pdf
    • https://cdn-cms.f-static.net/uploads/4408871/normal_5f9da5345ad5a.pdf
    • https://jajewivazag.weebly.com/uploads/1/3/4/4/134491582/88630.pdf
    • https://basipavegisu.weebly.com/uploads/1/3/4/3/134390368/nejawegapug_suvito_vavetava_jeviji.pdf
    • https://cdn-cms.f-static.net/uploads/4457302/normal_5fa741168d950.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://s3.amazonaws.com/solonebosop/71949948652.pdf
    • https://s3.amazonaws.com/zuguvoxoki/the_songhai_empire_economy.pdf
    • https://s3.amazonaws.com/xezonijida/functions_maths_iit.pdf
    • https://s3.amazonaws.com/patotale/weekly_pocket_planners_2019_2020.pdf
    • https://s3.amazonaws.com/tobobowu/motikozifobo.pdf
    • https://s3.amazonaws.com/palikuvexake/best_stroller_fan_amazon.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e440.bin
0775bd4da08b502a5f85d715a778be32698f3a28a8472f678691c18e2f2240b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE440 3244 bytes
font_01_sfnt_off0000effc.bin
5284892b3cecd1734dcd11076b4c9b05a702d048cfe34145c0be7720eef29840		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFFC 5692 bytes
font_02_sfnt_off00010361.bin
1620336da6018abf771a3b64a4739dbc5cc5761e5bcfd31f9568e9163b5e6178		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10361 2656 bytes
font_03_sfnt_off00010e68.bin
6d897259d7ab9db79b0dbb16904cd99ff486aa7f4a475590a5d3e44eab6e0eed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E68 2328 bytes
font_04_sfnt_off0001191e.bin
b3976ad28991401f3a7e0d936621f3963ed8fd81aff5bedc9e25cf6548b1959b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1191E 2108 bytes
font_05_sfnt_off000122f4.bin
995ba1a023bb0be145f00e582c43d5060d45ef465386ca7d918f2c6aa722d8ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122F4 14248 bytes
font_06_sfnt_off00014eb8.bin
ac398b520737ef5d97cf166ff746eb605039846392434f482bf0b1f494d33cb1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14EB8 16896 bytes
font_07_sfnt_off000166fa.bin
489ea0736659e4227260fd19b240cb51b6c3b4de1413d48cb2d2b1b06316a79e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x166FA 2644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.