Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f2979dfad9bf00b…

MALICIOUS

PDF

50.6 KB Created: 2020-12-17 06:20:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e53d01c42293b45ca7a39f8edd6e88fe SHA-1: 40870814efb48c3bcbabd10b08415d8282024f6b SHA-256: 5f2979dfad9bf00b665bb24836172f648e0387cd2890c4dd2d62c89dc9ec6361
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by ClamAV and ML classifiers, exhibiting characteristics of a phishing lure. The PDF_IMAGE_LURE heuristic indicates it's an image-only document with a clickable action, likely designed to trick users into visiting a malicious URL. The presence of multiple external links, including the suspicious trafftec.ru domain, further supports this assessment. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5897

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=ed+note+medical
    • https://ruwalabipuges.weebly.com/uploads/1/3/4/4/134465281/c092d673.pdf
    • https://static1.squarespace.com/static/5fce5f182c00fb194151f4ae/t/5fd6c7b813a48350e822132c/1607911355288/bgp_routing_interview_questions_and_answers.pdf
    • https://uploads.strikinglycdn.com/files/bcfdcbe5-2c02-47b9-832d-ff5f7e2c7c43/70224201741.pdf
    • https://uploads.strikinglycdn.com/files/682b7741-2234-4525-9989-3a524166ae4d/zugizuxugufep.pdf
    • https://static1.squarespace.com/static/5fbfdd38a3bf4b14aba341ea/t/5fc0db569b1ed03538fb7296/1606474583196/uf_official_transcript.pdf
    • https://uploads.strikinglycdn.com/files/e5ad963f-5b4a-4756-ab6e-82ce9da2db77/basilica_de_guadalupe_horarios_semana_santa_2019.pdf
    • https://static1.squarespace.com/static/5fc0e44e92c50b1a1e7784dc/t/5fcfd168cd2b6540a9f9f84d/1607455083248/lavufevudufazonanumi.pdf
    • https://uploads.strikinglycdn.com/files/b275ec74-ff32-4dbb-881a-6fe2167e8169/lijumiruvuf.pdf
    • https://uploads.strikinglycdn.com/files/8ed75baa-2c77-4467-89dd-db11584a1b38/guvodegadetorolaga.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.