Malicious PDF — malware analysis report

Static analysis result for SHA-256 a81cfee50a6793b3…

MALICIOUS

PDF

57.9 KB Created: 2020-11-11 22:55:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5e46ca25cb8ea2faa98f13ca24b6eda4 SHA-1: 24207b391eb6ee97cb14d70d5d6330f194e8447f SHA-256: a81cfee50a6793b35fdf4eea7a980abf450a42c857cdebfa1ba5a6fef1e40ab7
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting a malicious intent to redirect users. One of the primary external URLs observed is 'https://trafffe.ru/123?utm_term=uconn+dairy+bar+storrs'. While no scripts were explicitly extracted, the presence of numerous external links and a high ML score indicates a phishing or malicious redirection attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7703

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=uconn+dairy+bar+storrs
    • https://cdn-cms.f-static.net/uploads/4366017/normal_5fa469293cd7f.pdf
    • https://cdn-cms.f-static.net/uploads/4371799/normal_5f8b62850bb81.pdf
    • https://cdn-cms.f-static.net/uploads/4463551/normal_5fa5758095755.pdf
    • https://cdn-cms.f-static.net/uploads/4380882/normal_5f8fcf751e9ae.pdf
    • https://vofixerexelisat.weebly.com/uploads/1/3/4/3/134311693/5516444.pdf
    • https://cdn-cms.f-static.net/uploads/4414491/normal_5fa46a2add616.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wajufifenoxuj/game_meadow_cuphead.pdf
    • https://uploads.strikinglycdn.com/files/20ac0348-30cf-4b27-8ec9-379c33d8bba9/24107591041.pdf
    • https://s3.amazonaws.com/sorogamat/elementary_statistics_6th_edition_answers.pdf
    • https://uploads.strikinglycdn.com/files/2034dcf8-33dc-46f6-adf9-610f411c1438/52644254927.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c173.bin
ccd174435e5e49a4001b5f9680ef0efca33d050b3131ee70ed2cea65455eb99e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC173 5132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.