Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b80695dbb97138a…

MALICIOUS

PDF

64.0 KB Created: 2020-12-18 17:37:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 917bbbacd815db7d6585cf4e954282bf SHA-1: 7f278deba65a3904baf9b52b7f9728edbfcfa47c SHA-256: 8b80695dbb97138a41eaa7d0c1b48196faf59387d4868bf5b59ce52c9f88a886
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing attempt. It contains numerous external links, with a primary malicious URL pointing to 'https://traffset.ru/strik?utm_term=equalizer+apk+full', likely intended to deliver a payload. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, and the presence of PDF_SEO_LINK_FARM heuristic indicates a link farm strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6638

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=equalizer+apk+full
    • https://guzepebizosi.weebly.com/uploads/1/3/4/8/134880367/4743251.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b8b123b2-8962-48e4-8b7c-e3ea75fd220a/pokanesutulujetu.pdf
    • https://s3.amazonaws.com/vaxebisapesi/fipumozimijozo.pdf
    • https://uploads.strikinglycdn.com/files/ab98d95b-adf9-4266-b0f3-c7fca2fb91c1/thermarest_z_seat_blue.pdf
    • https://uploads.strikinglycdn.com/files/fb2a6199-8741-4fd6-a020-30ec91e913fc/97134052972.pdf
    • https://static1.squarespace.com/static/5fc2a58c40f1034a5cb42298/t/5fcade5fda45e86cca97bd8a/1607130720153/67965395116.pdf
    • https://s3.amazonaws.com/zowejunef/88508605306.pdf
    • https://uploads.strikinglycdn.com/files/52aa031d-2f02-40da-8484-a9ef30ca3627/uc_browser_apk_free_download_for_pc.pdf
    • https://uploads.strikinglycdn.com/files/35e908bd-6e44-41f7-ae0b-1a0ca1120ae9/law_of_universal_gravitation_problems_worksheet_answers.pdf
    • https://s3.amazonaws.com/jamuluvuvava/best_camera_apps_2018_android.pdf
    • https://static1.squarespace.com/static/5fdc9cf08d8ea14bdaa7a7fb/t/5fdcb52553796104502a857a/1608299813352/microsoft_flight_simulator_x_addons.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c2c5.bin
bd4c36db5590fa55592ba27ca811c04b8af77496cc4eeed5ac03bbaa6a45f8b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC2C5 4916 bytes
font_01_sfnt_off0000d3a4.bin
3862f15a55737551afd01bc1bf3d4b97538dae54f1f9cbcaeb90047ffbb7b3ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD3A4 12224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.