Malicious PDF — malware analysis report

Static analysis result for SHA-256 89e971167ee0450c…

MALICIOUS

PDF

50.6 KB Created: 2020-12-23 19:37:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: b78c311ba73ae8d7f2fc46b29d35bc7c SHA-1: 3b43f7c713c2f984f26701a809e42022085d735d SHA-256: 89e971167ee0450cf74ad2c9b2dc5368310687e1b52b12bea4d3c28adaf867cf
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'traffine.ru', which is likely part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, potentially for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7323

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=link++weathering+with+you PDF link annotation
    • https://cdn.sqhk.co/fakobijo/PtjfYhc/rilasex.pdfIn PDF document text
    • https://cdn.sqhk.co/vibifexode/fLjfFih/36858023065.pdfIn PDF document text
    • https://cdn.sqhk.co/situdejoj/LWVjhrP/car_simulator_2015_download.pdfIn PDF document text
    • https://vezikiga.weebly.com/uploads/1/3/0/7/130739663/mazasorobuvodutil.pdfIn PDF document text
    • https://cdn.sqhk.co/tadawatimi/Fuagi83/sniper_fighter_combat_elite_force_shooting_game.pdfIn PDF document text
    • https://cdn.sqhk.co/lotazoza/kvjbjji/bupatadokab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4077cafc-bc7c-4a00-96bd-91e03ce99fad/high_school_musical_the_musical_the_series_episode_2_google_docs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ab6999f-2359-4a5c-b3b2-f87d36eb3766/tanegunofanikan.pdfIn PDF document text
    • https://s3.amazonaws.com/dinisemowoge/tumiko.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30f8b095-3b90-4fa2-a2de-bc4eb6f9aeb0/45708123399.pdfIn PDF document text
    • https://s3.amazonaws.com/nonipesikiri/porter_s_value_chain_model_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a0c8aac-e44c-4b5d-b516-90cfd8c3794a/tugimapigepodepim.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.