Malicious PDF — malware analysis report

Static analysis result for SHA-256 436baf7022bf2740…

MALICIOUS

PDF

51.6 KB Created: 2020-11-24 08:23:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 97247bcb40ed5b2152799c5983db0b8b SHA-1: c80a286d4d12a70aa64fd8656bc181db93d7b528 SHA-256: 436baf7022bf2740c56a31af3f669c33c99b025d60e55e4d5f262d29aa727e1e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and ML classifiers, indicating a phishing or trojan distribution attempt. It contains a large number of external links, many of which point to PDF files, suggesting a link farm or SEO poisoning tactic. The primary malicious URL identified is trafftec.ru, which is likely used to host or redirect to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6781

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=cursive+writing+worksheets+pdf
    • https://sapixokevabose.weebly.com/uploads/1/3/4/4/134498139/xasovesoxopeje.pdf
    • https://cdn-cms.f-static.net/uploads/4385020/normal_5f9c6f6379f0b.pdf
    • https://cdn-cms.f-static.net/uploads/4404503/normal_5f9e5d4d11624.pdf
    • https://bajekilirevi.weebly.com/uploads/1/3/4/8/134868337/5b0565c883ec6.pdf
    • https://cdn-cms.f-static.net/uploads/4411493/normal_5fbb838562d82.pdf
    • https://cdn-cms.f-static.net/uploads/4373757/normal_5f9245eaa4af8.pdf
    • https://cdn-cms.f-static.net/uploads/4369932/normal_5f8d9b809effa.pdf
    • https://cdn-cms.f-static.net/uploads/4366341/normal_5fa35c7bb78e1.pdf
    • https://uploads.strikinglycdn.com/files/bc4f2c47-7cf6-4b92-8d0b-b0fd9aa45187/79573498354.pdf
    • https://uploads.strikinglycdn.com/files/a9050ea2-4b7f-4e06-965d-08d6714a9ba2/15940633455.pdf
    • https://uploads.strikinglycdn.com/files/b406b2cb-2928-4224-ab71-5ac5f4526ec1/54713900442.pdf
    • https://uploads.strikinglycdn.com/files/ecd1f370-e8e6-4934-a58f-1504361f8845/86180878651.pdf
    • https://uploads.strikinglycdn.com/files/59c518ba-c5e0-493f-9186-1bd8c2545d7b/6760247414.pdf
    • https://uploads.strikinglycdn.com/files/552f159b-3f37-473f-a819-233c7c1b3d73/81077548644.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.