Malicious PDF — malware analysis report

Static analysis result for SHA-256 87553369262b1692…

MALICIOUS

PDF

69.7 KB Created: 2020-11-17 05:55:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: f8e7cd5d737437f5587b6990c0da1005 SHA-1: bdedd7bbf8d2ebc81ae2e13d4a3d0a36a2cd81c2 SHA-256: 87553369262b169267514d9ea1a6e8e15b29ab3d25ea833bb95a03fd4b50fd94
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was identified as malicious by multiple heuristics and an ML classifier, indicating a phishing or trojan distribution attempt. It contains a link farm pointing to numerous external PDF files, likely intended to obscure the primary malicious URL. The primary malicious URL, https://trafffe.ru/strik?utm_term=how+to+download+app+not+available+in+your+country, suggests a lure related to downloading restricted applications, a common social engineering tactic. No scripts were extracted, but the PDF structure itself facilitates the redirection to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?utm_term=how+to+download+app+not+available+in+your+country PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4384048/normal_5faeb4c24fc5d.pdfIn PDF document text
    • https://sivifarikajuleg.weebly.com/uploads/1/3/4/4/134487261/dubukub.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368506/normal_5f87c329ce83e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402721/normal_5fa6d00120c3f.pdfIn PDF document text
    • https://jodawebodo.weebly.com/uploads/1/3/4/6/134634345/7606480.pdfIn PDF document text
    • https://wilubowedawiwo.weebly.com/uploads/1/3/4/5/134528918/8c474985acb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/43654683-9046-46ec-b46b-594f595f6706/62506234141.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30cc56b2-52af-4609-8f12-32595d8a7576/sisubud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3783785d-fa4b-418b-9f91-3f2531d375b7/65829487235.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3cd04598-7dae-463d-b100-b0b0c70566da/nusolusuxinirasewe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4847f89-cb8d-45ff-8b68-863f6175be3c/gutuneb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb225a7c-d6fa-4623-9b7d-7d3c34de10f2/apa_citing_images_in_text.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3D8 5244 bytes
SHA-256: ed1b9736af054488e21d74da7cba8f731959e817193476d4c23f3580fcc6be88
font_01_sfnt_off0000e5d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5D7 10604 bytes
SHA-256: d85f241bf891407609dc4f6feb1e954927c4d673597677beaf203eb305676f2f

Open this report in the interactive analyzer, or submit your own file for analysis.