Malicious PDF — malware analysis report

Static analysis result for SHA-256 ffe0dc5f1ea3eed5…

MALICIOUS

PDF

63.2 KB Created: 2020-11-06 19:56:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: f7fdfeccd66680264ea257ca267b1607 SHA-1: 6beaf0d5b6b913826ff1c5c39b5ac13218ae6972 SHA-256: ffe0dc5f1ea3eed5f07ddc486b1134e986573e727d43ae3509e01288bee6127d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to other PDFs, suggesting a link farm or SEO manipulation tactic. One prominent URL, 'https://traffking.ru/aws?keyword=upper+body+muscle+groups', is embedded and likely serves as the primary lure. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate malicious intent, possibly involving JavaScript execution to facilitate redirection or further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?keyword=upper+body+muscle+groups PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4378830/normal_5fa213c17d66b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367923/normal_5fa1c85f8fee5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365551/normal_5f8790a719e6e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374537/normal_5f8acc8bb2947.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383321/normal_5fa145fb8773b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407062/normal_5f9bed62b5c08.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464707/normal_5fa5302f9ce01.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369333/normal_5f9107cf35846.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sedimeraxufi/south_african_constitution_download_2017.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2504031-f0d2-48f4-b02c-e3095db8064c/79662557608.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9917331-6f57-4a08-9fcd-de70e0a1db04/4174139350.pdfIn PDF document text
    • https://s3.amazonaws.com/fasanag/72717949233.pdfIn PDF document text
    • https://s3.amazonaws.com/desenaz/borobozurupefurazofob.pdfIn PDF document text
    • https://s3.amazonaws.com/wujodibu/jixafokop.pdfIn PDF document text
    • https://xanafegeze.files.wordpress.com/2020/11/99519118409.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ae3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAE3F 5416 bytes
SHA-256: b8e2427a1c1e21196461ea3182731cfb104ddb561f0ebca0f5f07d91ec42132f
font_01_sfnt_off0000c093.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC093 1800 bytes
SHA-256: a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620
font_02_sfnt_off0000c920.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC920 11284 bytes
SHA-256: 842aabb4f89ddb3cd2d72b0b0d5926a9c76b250c38932da6793acec06d3885f8

Open this report in the interactive analyzer, or submit your own file for analysis.