Malicious PDF — malware analysis report

Static analysis result for SHA-256 47ff2493e80e4c24…

MALICIOUS

PDF

75.4 KB Created: 2020-12-25 05:16:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 317200a1612e371bd63a2257833d4fe1 SHA-1: e054f402b77392bbf587a56e4b4a68ba5cc2d342 SHA-256: 47ff2493e80e4c2464b803a61fd92b715b8de96d703963a33aa384a46b15d7bc
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, many pointing to disposable hosting services, suggesting a link farm designed for SEO manipulation or phishing. The primary URL, 'https://traffnew.ru/strik?utm_term=derailed+movie+2018+trailer', indicates a lure related to a movie trailer, likely to entice users to click through to a malicious site. ClamAV detection and ML classification further support its malicious nature, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=derailed+movie+2018+trailer PDF link annotation
    • https://romevezijije.weebly.com/uploads/1/3/4/7/134756673/5ac4d4c1e083052.pdfIn PDF document text
    • https://latudawa.weebly.com/uploads/1/3/4/3/134308630/goxosajovupikad_kusozibizavite.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414672/normal_5fcbdd099117b.pdfIn PDF document text
    • https://gojudewusidaza.weebly.com/uploads/1/3/4/8/134888042/4193488.pdfIn PDF document text
    • https://cdn.sqhk.co/tiwumixe/Zto8Bje/magnum_ice_cream_triple_chocolate.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384035/normal_5f9f304a73f11.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a62348c-39ae-4dc0-b091-e2826f0e6701/9999583149.pdfIn PDF document text
    • https://s3.amazonaws.com/wexoteluwag/james_berryman_medford_oregon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c6151a1-3f25-43a4-8dbd-ceba2483439e/zitevenaxofomoxot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b567495-7f42-4005-960e-3e21a835d433/nations_and_nationalism_since_1780_summary.pdfIn PDF document text
    • https://s3.amazonaws.com/mixanaz/grouped_frequency_table_worksheet_ks3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/658d08cc-825a-48ee-bec3-3cbb7f14edab/wirojabiramojomek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/849dd93c-e1ed-4eb8-8be6-677c442d3375/52499221357.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3916bcf9-0898-4784-8597-1bedba84f1ef/gowamagasu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5c8fd1d-7253-483f-bdee-9d826f8de8fa/visaxa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8A2 5372 bytes
SHA-256: f2fc85983d144fe091fc8ccd307447988c16cd511ed202b68d6b23243a94dc45
font_01_sfnt_off0000fadd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFADD 11224 bytes
SHA-256: 381915d1ed5bc8750dced0c3f7bf0a50f7943c3a6a941ad4057c5cc6aeaf183a

Open this report in the interactive analyzer, or submit your own file for analysis.