Malicious PDF — malware analysis report

Static analysis result for SHA-256 452eb10600152300…

MALICIOUS

PDF

100.2 KB Created: 2020-12-14 03:20:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 75f1b170b8c8ebba4fd9a6740db2defd SHA-1: c23c00dda1b357b9b1419d639a3417a3edf29a5b SHA-256: 452eb10600152300bb122573eaa3d73f5c02e399a8a77d46a15807fd1d9909d3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO spam or phishing campaigns. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, and the ClamAV detection 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0' strongly suggests malicious intent. The embedded URL 'https://traffine.ru/strik?utm_term=schumacher+battery+charger+1.5+amp+manual' further supports the lure of a battery charger manual to direct users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8545

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=schumacher+battery+charger+1.5+amp+manual
    • https://sugelazo.weebly.com/uploads/1/3/4/7/134767002/valesur.pdf
    • https://cdn-cms.f-static.net/uploads/4389376/normal_5fd33db6ce492.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/kiwopusafize/criminal_law_case_studies.pdf
    • https://uploads.strikinglycdn.com/files/60ce56d0-fb00-43ce-af64-6c0a0bec3193/85898639871.pdf
    • https://uploads.strikinglycdn.com/files/ddf63062-bb4c-4b3a-a72e-d2ca5cbe5212/86209981654.pdf
    • https://uploads.strikinglycdn.com/files/e4292ebf-ff12-4267-8900-80bfe83de923/naluwuk.pdf
    • https://s3.amazonaws.com/fulosobezur/charting_by_exception_definition_nursing.pdf
    • https://s3.amazonaws.com/pexodugosa/anova_sous_vide_instruction_manual.pdf
    • https://s3.amazonaws.com/vipinib/65721103316.pdf
    • https://uploads.strikinglycdn.com/files/71b08445-8ff8-43ab-8ef9-2c998c1a9a86/xenizewuvolejojulojeko.pdf
    • https://s3.amazonaws.com/jadudusujuje/salimit.pdf
    • https://uploads.strikinglycdn.com/files/df38a6e8-54b4-4a80-9cda-2f8e60853c7d/piano_keyboard_cheat_sheet.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015eb6.bin
1ca54a15a26c5bccc2249d5dbd15f1b3693c15562e5f063fe207f388aa0ebf66		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15EB6 5720 bytes
font_01_sfnt_off0001721e.bin
39e76a8ccffcf2894fbe0fc05be2223783a05c6e4f1712ce87e700ddf57c362f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1721E 2200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.