Malicious PDF — malware analysis report

Static analysis result for SHA-256 992fb4ff813e6b3c…

MALICIOUS

PDF

61.1 KB Created: 2020-11-11 02:56:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b641ae6d6985879f69c8a1d2740ae1c2 SHA-1: e9c8ec057ba9f32be28d38d7defe27d5ea44d10c SHA-256: 992fb4ff813e6b3c8416f050a572f3f1de707fbd01b84473d1313fa0cdc74d99
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-heavy nature and a single clickable action. It contains multiple external links, with one suspicious URL (`https://traffnew.ru/aws?keyword=sat+times+2019`) being a primary indicator of malicious intent. ClamAV and ML classifiers also flagged this PDF as malicious, suggesting it's a trojan designed for phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6688

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 61 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?keyword=sat+times+2019
    • https://cdn-cms.f-static.net/uploads/4376869/normal_5f9ca052d40fb.pdf
    • https://vuguzakinizole.weebly.com/uploads/1/3/4/4/134493236/4d0c42da1d8f.pdf
    • https://cdn-cms.f-static.net/uploads/4412758/normal_5f969283a850b.pdf
    • https://cdn-cms.f-static.net/uploads/4402711/normal_5f93f2d891820.pdf
    • https://s3.amazonaws.com/vukumesoj/describing_words_that_start_with_u.pdf
    • https://s3.amazonaws.com/nakevoja/color_switch_online_game.pdf
    • https://uploads.strikinglycdn.com/files/668ddabe-2125-4deb-825c-9571ed2215ab/tosesogamujanep.pdf
    • https://uploads.strikinglycdn.com/files/22daf013-ccff-4d20-ac19-67a961c99f94/.pdf
    • https://uploads.strikinglycdn.com/files/db19dc38-2c1f-4b6c-bbe2-dfec752435c1/bimexuxomok.pdf
    • https://uploads.strikinglycdn.com/files/baddd4ad-3dd3-4c0d-ba24-7ef5fe847325/fujuzefedurilezuxag.pdf
    • https://uploads.strikinglycdn.com/files/a2a3b798-73a0-4abd-81a2-cb431f6ea333/hd_movies_app_2019.pdf
    • https://uploads.strikinglycdn.com/files/ae3bd2fa-620d-4f2b-afb5-5bde6a84b155/70715381717.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.