PDF malware analysis — malicious · 46cc95edb0cc9ada

MALICIOUS

PDF

67.6 KB Created: 2021-01-11 09:40:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17

MD5: a72cec166c89e8743dbf721342902433 SHA-1: 668514cb5a4251de4e1f5b051c5c82b0ee1fbbf8 SHA-256: 46cc95edb0cc9ada15a4c2467994d60c3faeaeae3dd8b754563044abffe84ee5

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it is part of a link farm designed to drive traffic to potentially malicious websites. One of the extracted URLs, 'https://trafficel.ru/aws?utm_term=pictures+background+music+software+free', appears to be a lure for free software, which is a common tactic for phishing or malware distribution. No scripts were extracted, but the presence of numerous external links and the overall detection profile strongly suggest a malicious purpose.

Machine Learning

Nyx PDF Classifier malicious score 0.9719

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/aws?utm_term=pictures+background+music+software+free PDF link annotation
- https://static.s123-cdn-static.com/uploads/4388276/normal_5ff7b7fd41aa2.pdfIn PDF document text
- https://cdn.sqhk.co/baluwofuk/3oggdhg/83004455079.pdfIn PDF document text
- https://site-1172855.mozfiles.com/files/1172855/89106190545.pdfIn PDF document text
- https://site-1185312.mozfiles.com/files/1185312/gojeta.pdfIn PDF document text
- https://cdn.sqhk.co/jutafegobexe/WLCMRv6/75096723675.pdfIn PDF document text
- https://gibuzilo.weebly.com/uploads/1/3/4/6/134602166/mekimukuxewex_warapanagitu_rikugaba_borakobede.pdfIn PDF document text
- https://cdn.sqhk.co/woxipepevati/DihFKPa/classic_bubble_shooter_level_656.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368489/normal_5f8a31759db00.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4503617/normal_5fde30e6da97a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485587/normal_5faba71233f76.pdfIn PDF document text
- https://cdn.sqhk.co/tavikalamo/fQ4Jhfc/sad_song_ringtone_download_music.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418755/normal_5fd3b33e80e6b.pdfIn PDF document text
- https://cdn.sqhk.co/tajiwikiter/hdHkhiu/38775820966.pdfIn PDF document text
- https://didefitelov.weebly.com/uploads/1/3/0/8/130874246/9846371.pdfIn PDF document text
- https://cdn.sqhk.co/nujidegowupi/hgC4XaC/big_rig_travels_youtube_new_mexico.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ef72.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEF72	5604 bytes
SHA-256: `b90626f6b6402720c3c1552b3fad8bda5a4b0d5a2b332e8e7e21dc8229f1edae`

Open this report in the interactive analyzer, or submit your own file for analysis.