Malicious PDF — malware analysis report

Static analysis result for SHA-256 11a6217bf5ea5da5…

MALICIOUS

PDF

50.6 KB Created: 2020-12-23 10:17:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b6744fa03797a68e6168bdca76077599 SHA-1: d7c3e8c1b382bff679c8ae49960f3b0664829c29 SHA-256: 11a6217bf5ea5da5efd39620d6596b2eab36e8b30c3f647ac9e73fda7b4017d8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ClamAV detection and ML classifier indicate malicious intent, specifically identified as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded links suggest an attempt to drive traffic to potentially harmful URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7198

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=environmental+risk+assessment+report+pdf
    • https://cdn-cms.f-static.net/uploads/4406501/normal_5fa39252ef286.pdf
    • https://cdn-cms.f-static.net/uploads/4365594/normal_5f8c2b15b6ea9.pdf
    • https://momaramurelu.weebly.com/uploads/1/3/4/3/134309976/wizexutafalivobazag.pdf
    • https://duloduwo.weebly.com/uploads/1/3/4/8/134850843/3850342.pdf
    • https://nitikado.weebly.com/uploads/1/3/4/6/134660078/xufenuf_ladefakogi.pdf
    • https://safasisi.weebly.com/uploads/1/3/4/4/134472516/923441.pdf
    • https://cdn-cms.f-static.net/uploads/4385422/normal_5f978ed5ad2df.pdf
    • https://cdn-cms.f-static.net/uploads/4367941/normal_5f8b5198ee588.pdf
    • https://static.s123-cdn-static.com/uploads/4482872/normal_5fcc82f429700.pdf
    • https://tabogivazosepa.weebly.com/uploads/1/3/1/8/131871767/5557527.pdf
    • https://s3.amazonaws.com/rurovikejigibu/auriculoterapia_ansiedade.pdf
    • https://uploads.strikinglycdn.com/files/5c09c490-c739-4c9f-95b8-d3efd79692b6/runed_arcanite_rod_recipe_vendor.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.