Malicious PDF — malware analysis report

Static analysis result for SHA-256 adeac41ba4b05df5…

MALICIOUS

PDF

66.6 KB Created: 2020-12-19 15:11:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 078d7b4c757acb982c1bf1b5da3607de SHA-1: fa7d57f1d9a4a2b734ec30755124e67967fbe9b0 SHA-256: adeac41ba4b05df53a7978f71d8f1effc6b895e7d9e6acc0cb639ce8bb7b3fc2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains numerous external links, with a critical heuristic identifying it as a PDF link farm. One of the primary external URIs points to 'trafffi.ru', suggesting a malicious intent to redirect users. The ML classifier and ClamAV detection further support its malicious nature, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9627

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=blynk+app+for+android PDF link annotation
    • https://norumevi.weebly.com/uploads/1/3/0/9/130969469/b93b5b6d40689.pdfIn PDF document text
    • https://wubenigulusetib.weebly.com/uploads/1/3/4/7/134712949/nilelenabaremi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c3a3bda-6aea-4dc5-9abc-836e46a7cc3f/18187448830.pdfIn PDF document text
    • https://s3.amazonaws.com/kijelopazekune/94471131480.pdfIn PDF document text
    • https://s3.amazonaws.com/sefiwegegagu/84477513876.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea12ffeb-bc36-4d26-8823-b313778c1841/afk_arena_hack_ipa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fb15ce5-0572-4338-92d4-6955b8d72e88/vawaxapepiwagowizubekozax.pdfIn PDF document text
    • https://s3.amazonaws.com/lixasifasi/30381014772.pdfIn PDF document text
    • https://s3.amazonaws.com/bikikanafopavu/cursive_letter_j_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/96da1d17-54c3-4345-962c-a5027e89f18e/29167473882.pdfIn PDF document text
    • https://s3.amazonaws.com/fasanag/mimoweratewemekowegapuvi.pdfIn PDF document text
    • https://s3.amazonaws.com/firigugixujotov/technical_engineering_report_example.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4B1 4664 bytes
SHA-256: dd2ceb9c0ab664007aa905b9a3d498826b066e7faf69f7277d40afbe5dd2ddd3

Open this report in the interactive analyzer, or submit your own file for analysis.