Malicious PDF — malware analysis report

Static analysis result for SHA-256 4dbacee0b3502463…

MALICIOUS

PDF

124.2 KB Created: 2020-11-18 10:13:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a0e2ecd9711fadce8dce374861ab99ea SHA-1: f681ee5478809d65a4b4f0a2394a816707f5d45e SHA-256: 4dbacee0b350246308b58277a6f5149dcb9f1ad50d8f308c744b3971500a184b
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which are likely part of a link farm designed to direct users to malicious sites, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The primary malicious URL identified is 'https://trafffe.ru/strik?utm_term=russian+fishing+4+starter+guide', which is likely used for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9276

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?utm_term=russian+fishing+4+starter+guide
    • https://puxugewukuniw.weebly.com/uploads/1/3/4/4/134492634/2002342.pdf
    • https://tilawebaxipas.weebly.com/uploads/1/3/4/5/134576196/6965675.pdf
    • https://cdn-cms.f-static.net/uploads/4404975/normal_5fad23bd50617.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lejivugeleguwod/douwe_egbert_coffee_concentrate.pdf
    • https://uploads.strikinglycdn.com/files/c6809c71-c6fc-4ffe-a2bf-4391b55598e2/patrick_s_music_school.pdf
    • https://uploads.strikinglycdn.com/files/2d020bdd-bc2a-4f73-82d6-5043b9557bea/human_environment_interaction_in_india.pdf
    • https://uploads.strikinglycdn.com/files/79b73043-3f4d-43e8-b12b-011ebe6cab95/nfs_mw_apk_download_for_pc.pdf
    • https://s3.amazonaws.com/webipejonavuv/61503146218.pdf
    • https://uploads.strikinglycdn.com/files/5c4db4fe-0dd9-4d56-996c-231bdfc9b12b/xupenuduk.pdf
    • https://s3.amazonaws.com/gajabedafot/not_contractions_worksheets_for_first_grade.pdf
    • https://uploads.strikinglycdn.com/files/4cfe170b-8f51-446f-ab7d-b7f0bab10811/90185597106.pdf
    • https://uploads.strikinglycdn.com/files/553400a3-42ca-4feb-84a0-9b0ab5b31897/axxess_tyto-01_installation_guide.pdf
    • https://s3.amazonaws.com/legenapi/luzajavomazixapubunowul.pdf
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001ccc8.bin
9f9281e05d850dfdb347f8f369f83dfb5eef8e045f9eaa437624f7c0abbc73aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CCC8 5232 bytes
font_01_sfnt_off0001de97.bin
b91f3c26f37c28538ed09035cbea6f9221827f1e30b50c452f08cc820bcc167b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DE97 3720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.