Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff06afdfb4adacbc…

MALICIOUS

PDF

73.6 KB Created: 2021-02-20 17:42:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 8b271f82e6a705fb20397a2137687bd4 SHA-1: 772810b37690a4843a4250e12d6b848ae2682cd7 SHA-256: ff06afdfb4adacbc4f07d8ea1886d3d585d8c87a363deac40d959f7eae4669d5
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to link farms hosted on services like Weebly, indicating a phishing or malware distribution campaign. One critical heuristic identified a link to known malicious redirector infrastructure. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or trojan delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/123?utm_term=taotao+dealer+near+me In PDF document text
    • https://serutoposax.weebly.com/uploads/1/3/5/3/135398922/c50261.pdfIn PDF document text
    • https://fozirufimagez.weebly.com/uploads/1/3/0/9/130969558/1316395.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367644/normal_5fe422425f66f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378160/normal_600e6de670865.pdfIn PDF document text
    • https://romenazojojeles.weebly.com/uploads/1/3/0/7/130775884/fe19c9.pdfIn PDF document text
    • https://viwoseloza.weebly.com/uploads/1/3/4/8/134861971/pokidemumavedibas.pdfIn PDF document text
    • https://gezajinesobovu.weebly.com/uploads/1/3/2/3/132303035/xejamowupagurelaliv.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393785/normal_600766b1b885f.pdfIn PDF document text
    • https://sanituwinera.weebly.com/uploads/1/3/1/3/131379206/e1b9835.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383794/normal_602216799ad44.pdfIn PDF document text
    • https://cdn.sqhk.co/reposivekow/HsMFiaI/buy_missile_command_arcade_game.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403429/normal_5fc8c2e1e1171.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416504/normal_5ff64cbe8c9f2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4475570/normal_5ff8aa372be4a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383567/normal_5feb36904b373.pdfIn PDF document text
    • https://cdn.sqhk.co/lenufetimop/X7Z5jbr/woworozizo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366397/normal_5fd26c5f6fb3b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://mabobasator.epizy.com/nugelibu.pdfIn PDF document text
    • http://difavokagakaruw.epizy.com/bijuzo.pdfIn PDF document text
    • http://wutagokavejeve.rf.gd/87923353535.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e700.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE700 4740 bytes
SHA-256: f79bd45bed75462fe09e98ffd42d52e748a6aac939833319867f328a213871ee
font_01_sfnt_off0000f705.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF705 10312 bytes
SHA-256: 47de200a79148a4f07c23a7f57e44d1a6b734dd57f536abb2d1155ad818c6637

Open this report in the interactive analyzer, or submit your own file for analysis.