Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3969099b05fe809…

MALICIOUS

PDF

84.6 KB Created: 2020-11-10 07:43:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9e807dfd4aeb67b63031994f4974bf53 SHA-1: ad6d342e80d6067e1372123a2025d52235fd244f SHA-256: b3969099b05fe80948caff683f0f4aabaafc335b65c93ba11e5d4e83927898b6
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many pointing to PDF files hosted on file-sharing services, indicative of a link farm or SEO abuse. One of the embedded URIs, 'https://trafffi.ru/aws?keyword=selena+quintanilla+autopsy+photos', suggests a lure for potentially sensitive or sensational content. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8810

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?keyword=selena+quintanilla+autopsy+photos
    • https://mapipuluzobeb.weebly.com/uploads/1/3/1/3/131398440/xexakivepixona-pajof-davewuza-sasetoj.pdf
    • https://nupirunu.weebly.com/uploads/1/3/4/2/134265900/porik-xegefuxiri.pdf
    • https://togelugifipa.weebly.com/uploads/1/3/4/6/134648123/7775054.pdf
    • https://kisotupojez.weebly.com/uploads/1/3/4/4/134493444/sevanoruti_rufurefofax_ponuwunedimebe.pdf
    • https://zazetafulunemu.weebly.com/uploads/1/3/4/5/134599809/mimegubofiwo.pdf
    • https://dovogejeromew.weebly.com/uploads/1/3/4/6/134666082/6f6f668b64591.pdf
    • https://nupureforisuro.weebly.com/uploads/1/3/4/3/134353583/5657021.pdf
    • https://uploads.strikinglycdn.com/files/c634fecb-7dd0-4c77-ad5c-92141c799f71/95509907441.pdf
    • https://s3.amazonaws.com/wegemebufojafak/vokenewemutatok.pdf
    • https://uploads.strikinglycdn.com/files/49b8bf28-246e-4e0c-9c9c-a65c7d06ec64/fijutotavutanowe.pdf
    • https://uploads.strikinglycdn.com/files/0bc4c6e1-56eb-42d8-8dd6-4c0b8168632a/gatazalexejemifafur.pdf
    • https://s3.amazonaws.com/somamere/40511711503.pdf
    • https://uploads.strikinglycdn.com/files/ed6b6d96-f973-4bf3-9f31-22fb148276a2/zalegipixobemadarukekig.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.