Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bf2450a540536bb…

MALICIOUS

PDF

49.6 KB Created: 2020-11-14 03:57:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: f46ed7d94d7923dd0fe9dbf509e4be1a SHA-1: 4ad38d98455b3e9e9d0e84d90d044cd45932ec49 SHA-256: 7bf2450a540536bb483b8a2c6b5b8271b48d7d6899b9cbf6c271d679d7582210
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file, disguised as a 'joint custody calendar template', contains numerous external links, with one pointing to 'trafffi.ru'. This behavior, combined with ClamAV detection as 'Pdf.Phishing.Trojan', strongly suggests a phishing or malware distribution attempt. The presence of PDF_URI and PDF_SEO_LINK_FARM heuristics further supports this, indicating the document is part of a link farm designed to direct users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9669

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=joint+custody+calendar+template PDF link annotation
    • https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/rotesojelunemiroto.pdfIn PDF document text
    • https://lodobimamavudug.weebly.com/uploads/1/3/4/3/134306091/4718287.pdfIn PDF document text
    • https://s3.amazonaws.com/titugome/hunter_s_thompson_hell_s_angels.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a51e758-4a99-4f30-b7da-bd7a65c40e90/jutet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9088cd76-63a5-4382-8211-201e7d103424/montgomery_ward_catalog_1895.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5be8171-4ef6-4e06-b702-05ef00cc959c/xetezinaj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf4735a7-a984-469f-9f00-af9e93dfa86a/menzil_ilahisi_indir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1eabb85d-1975-4ba7-bff4-8323496b0259/70365943314.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d0c94ea-11c6-46d5-bc8f-bfcf7eaf93d2/infant_optics_dxr-8_video_baby_monitor_troubleshooting.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17326599-e6f7-4d69-8239-92cc799a1f97/conquistador_maynard_ferguson_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/vikukinumet/3099553347.pdfIn PDF document text
    • https://s3.amazonaws.com/regegozumekoza/dnd_5e_bullywug_stats.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0be3db78-58ff-4d15-bc39-f3fa9ae2bde4/gisejezaxakaxiretibimu.pdfIn PDF document text
    • https://s3.amazonaws.com/baxekojojexusol/death_on_two_legs_lyrics_meaning.pdfIn PDF document text
    • https://s3.amazonaws.com/defipedibe/swtor_jedi_sentinel_guide_6.0.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.