Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a323344435f8177…

MALICIOUS

PDF

61.7 KB Created: 2020-11-19 01:42:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e75bcfd7e6991dbf79aa553ed9eef90d SHA-1: 0a82b66ff2f33bdcb4a334417f02d3bc6e4a6855 SHA-256: 5a323344435f81778b5cd0cf90db0ee9ed0b8c0ffb6f6296698899d7ba87a8dc
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, and it contains a large number of external links, many of which are likely part of a link farm. The primary URL, "https://trafficel.ru/strik?utm_term=human+physiology+fox+test+bank", suggests a lure to a potentially malicious or phishing site. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate a malicious intent to redirect users to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7544

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=human+physiology+fox+test+bank
    • https://cdn-cms.f-static.net/uploads/4370064/normal_5f962db1cbf63.pdf
    • https://cdn-cms.f-static.net/uploads/4386620/normal_5fab6870b4c20.pdf
    • https://masogipu.weebly.com/uploads/1/3/1/6/131606875/pinipavofi-sapetituro.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b6b367b3-9265-4f5f-8f4c-d9279dda02ae/nomizelujeju.pdf
    • https://uploads.strikinglycdn.com/files/b2f21c87-0f60-4e2c-ae2e-35b25fe3784a/sitting_bull_academy_apple_valley_ca.pdf
    • https://uploads.strikinglycdn.com/files/8188dee9-1c9e-4a63-8dbe-631981014be0/mututemejalaro.pdf
    • https://uploads.strikinglycdn.com/files/13deaa79-5a59-4cf0-9838-c443c41d7b97/faust_english.pdf
    • https://s3.amazonaws.com/tiluwisulepam/casio_gw1500a_manual.pdf
    • https://s3.amazonaws.com/mijedusovineti/hulu_live_tv_channels_printable_list.pdf
    • https://s3.amazonaws.com/kufazete/mountain_bike_stem_sizes.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3c2.bin
2ed53878cfe4a756f7b750bbc570937e80a04d4ea65732c75d95ff0f60e9ad5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD3C2 5556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.