Malicious PDF — malware analysis report

Static analysis result for SHA-256 098f15fc971269ac…

MALICIOUS

PDF

51.0 KB Created: 2020-11-19 08:36:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 314c04467ab787379e58c742f5d71a8a SHA-1: 20fc85b1d6678162a79f1dceb80dfc84e39f1667 SHA-256: 098f15fc971269ac58a0aa8fff49ea171f4ec082ec41ffe8e03cfc2583c06490
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous external links, a common tactic for link farms or phishing lures, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The presence of a malicious URL and ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards an attack pattern involving malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7145

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?utm_term=docker+deep+dive+nigel+poulton+pdf+download
    • https://dopotalufiru.weebly.com/uploads/1/3/4/6/134601398/fowaxekisix_wopizububifir_mafiwatado_pesaxolu.pdf
    • https://cdn-cms.f-static.net/uploads/4379476/normal_5f8c65b6bca51.pdf
    • https://cdn-cms.f-static.net/uploads/4448103/normal_5fa22a884b0e2.pdf
    • https://cdn-cms.f-static.net/uploads/4420939/normal_5f987d61821bf.pdf
    • https://cdn-cms.f-static.net/uploads/4427519/normal_5fb5a280d8ed4.pdf
    • https://cdn-cms.f-static.net/uploads/4368740/normal_5f8dde6818c24.pdf
    • https://cdn-cms.f-static.net/uploads/4375708/normal_5fa7de5f05deb.pdf
    • https://wajiresejepo.weebly.com/uploads/1/3/0/7/130774962/geropuzonivuvej.pdf
    • https://s3.amazonaws.com/jinabom/new_tamil_movie_online_download_in_marinarockers.pdf
    • https://uploads.strikinglycdn.com/files/b2405837-4a84-43b1-9fdd-a4ee32ed4bf5/complete_guide_to_aromatherapy_3rd_e.pdf
    • https://s3.amazonaws.com/zirojopemup/balanza_de_laboratorio.pdf
    • https://s3.amazonaws.com/levovod/binomial_theorem_tutorial.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.