Malicious PDF — malware analysis report

Static analysis result for SHA-256 861cb5ec863070af…

MALICIOUS

PDF

65.6 KB Created: 2020-11-17 10:25:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fa7e6f184ac87b7eca33df2c9308284e SHA-1: a4f3d1397b8e1fcd3fb72d5cc25e2e8780e245c0 SHA-256: 861cb5ec863070af7c1184ef3500eeec981c0dce6315074e402e29ed0a999297
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ggtraff.ru/strik?utm_term=pdf+physique+chimie+terminale+s+hach'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links. The ML classifier and ClamAV detection further support its malicious nature, indicating it's likely a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9627

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?utm_term=pdf+physique+chimie+terminale+s+hach
    • https://xonedapu.weebly.com/uploads/1/3/4/6/134654428/7007802.pdf
    • https://juzuxadubibipa.weebly.com/uploads/1/3/4/6/134685448/e8015ab8aec2c1.pdf
    • https://pasabegimukug.weebly.com/uploads/1/3/4/2/134265340/726928dc5e8ad5b.pdf
    • https://lififamofupuge.weebly.com/uploads/1/3/4/3/134317858/09f36.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/rupatojuko/lejowozala.pdf
    • https://s3.amazonaws.com/kelageketisefuv/pho_viet_dover_de.pdf
    • https://s3.amazonaws.com/gajejasa/vufuvib.pdf
    • https://uploads.strikinglycdn.com/files/dbbbae82-2f40-4463-9a44-ecc12a2d8228/44172644504.pdf
    • https://uploads.strikinglycdn.com/files/5c544dec-f99c-48d0-b6f1-1947bb7674fd/73128675294.pdf
    • https://s3.amazonaws.com/kiwopusafize/boost_juice_bar_menu.pdf
    • https://s3.amazonaws.com/mejawiwomak/all_important_dates_in_indian_history.pdf
    • https://s3.amazonaws.com/titugome/fuxajoriguba.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea01.bin
b90c782c282037b7c2e592f081c2bf0f02d622dbe9c5747813284365deb9dae6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA01 5624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.