Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9e527a1402ac5a0…

MALICIOUS

PDF

128.0 KB Created: 2020-11-11 10:00:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 153b086195078ef74f95fa55409b50d8 SHA-1: 16df959c585c2ac410152583a3366d3527af0646 SHA-256: a9e527a1402ac5a02930486b99ba2b2cda0ac64504a56739d5b37ab1cf614073
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are to other PDF files, suggesting a link farm or SEO manipulation tactic. One prominent URL, 'https://trafffi.ru/123?keyword=girlfriends+guide+to+divorce+rotten+tomatoes', is likely part of a phishing or scam campaign. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8789

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?keyword=girlfriends+guide+to+divorce+rotten+tomatoes
    • https://cdn-cms.f-static.net/uploads/4375195/normal_5f8c3a32f1f6e.pdf
    • https://cdn-cms.f-static.net/uploads/4392474/normal_5fa5d3fa2906c.pdf
    • https://cdn-cms.f-static.net/uploads/4381090/normal_5f8d04582ce0b.pdf
    • https://kifelulamexeb.weebly.com/uploads/1/3/4/3/134310841/bibow-sezomokusivo-zerupolurisulir-resekamuzomi.pdf
    • https://cdn-cms.f-static.net/uploads/4375077/normal_5f93cc3569dbe.pdf
    • https://cdn-cms.f-static.net/uploads/4444630/normal_5fa712377e690.pdf
    • https://jerexibim.weebly.com/uploads/1/3/4/6/134654770/gesipapugijevo.pdf
    • https://cdn-cms.f-static.net/uploads/4413126/normal_5fa3c0f2b9f3b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f13a4ab3-4964-405a-84d1-49b877f7c138/banefejodem.pdf
    • https://s3.amazonaws.com/gupuso/xideritegode.pdf
    • https://s3.amazonaws.com/xovajukoxin/rikadetupiniwek.pdf
    • https://s3.amazonaws.com/tabobujimo/klasifikasi_rhizophora_apiculata.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001866e.bin
b62018e8a7c30e39e7853be7f28ecf70531dd6fad132c81665e2e4557e4b3fa4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1866E 23152 bytes
font_01_sfnt_off0001ce68.bin
21404201804979a00d65c440354826c3d478d46d09cb46318fcba96a028252fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CE68 5432 bytes
font_02_sfnt_off0001e0d8.bin
388d281580c4b9b3bebc418fce175c36685cd0745fc48da0c62b7550990f0d5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E0D8 10672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.