Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c0013f3d524398a…

MALICIOUS

PDF

52.6 KB Created: 2020-12-07 14:13:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9b1822833ea5e48e0d838ef7b0773eba SHA-1: 3030ea19fc1f5245bdde93262470018b07d2528e SHA-256: 0c0013f3d524398aec573d5ac4522bb145adf5130a922376758d71950c9d914a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, including one to 'traffset.ru/strik', suggesting a phishing or redirection attempt. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of generated links, further supporting this. ClamAV detection as 'Pdf.Phishing.Trojan' confirms malicious intent, likely to distribute further payloads or phish credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9382

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=xc60+manual+transmission
    • https://zelapagetuwuj.weebly.com/uploads/1/3/1/4/131406140/pejixolexedij.pdf
    • https://fukoxifixe.weebly.com/uploads/1/3/4/4/134460993/pugefudukamurovenox.pdf
    • https://cdn-cms.f-static.net/uploads/4375207/normal_5f8eccb477eec.pdf
    • https://static.s123-cdn-static.com/uploads/4423699/normal_5fc8da40754db.pdf
    • https://cdn-cms.f-static.net/uploads/4373304/normal_5f9f8c1fe1be8.pdf
    • https://cdn-cms.f-static.net/uploads/4489042/normal_5fbc91da8b0c2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zidosozawok/96836664145.pdf
    • https://uploads.strikinglycdn.com/files/6ba82df7-b384-4c01-bcf4-1ec20db356e4/honda_vfr800_vtec_service_manual_dow.pdf
    • https://uploads.strikinglycdn.com/files/8bc5ced7-ca66-40e0-ab82-a09e76dd7c2b/hypixel_skyblock_resource_pack_pets.pdf
    • https://s3.amazonaws.com/dinigugaxej/47972485668.pdf
    • https://s3.amazonaws.com/nowonovege/craigslist_roseburg_or_garage_sales.pdf
    • https://uploads.strikinglycdn.com/files/dc7aaed7-cddb-47d9-8b9c-40157411171a/vupimu.pdf
    • https://uploads.strikinglycdn.com/files/579e5ee2-86ec-4cf9-b9ae-c01b49ce7c0c/chapter_3_oasis_guidance_manual.pdf
    • https://s3.amazonaws.com/panokojol/avondale_high_school.pdf
    • https://s3.amazonaws.com/woxojuxafopuv/60790329664.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bceb.bin
7d392ebfa2a40f3645e31008a030a09dfc7afe8cf6efc0e0b9a761a7a4053ae8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBCEB 5220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.