Malicious PDF — malware analysis report

Static analysis result for SHA-256 b57e5ba8bd1af583…

MALICIOUS

PDF

50.6 KB Created: 2020-12-15 20:19:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 93fd3546cb02700bc742622f27e779a4 SHA-1: bf231fa709f0f72ddef61ea65669c8dffff73e16 SHA-256: b57e5ba8bd1af5833928bb40084286e7ae913aa6453f33bee6731901209f5fc1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'traffine.ru'. The ML classifier also flagged the PDF with high confidence. While no scripts were extracted, the presence of a malicious URL strongly suggests an attempt to lure the user to a compromised site, likely for phishing or to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9729

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=come+thou+fount+piano+sheet+music+easy In PDF document text
    • https://cdn-cms.f-static.net/uploads/4374839/normal_5f92d8a3bd802.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409796/normal_5fa3e70e0619c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490251/normal_5fc9ddfa2d4db.pdfIn PDF document text
    • https://lusasapefo.weebly.com/uploads/1/3/4/2/134234623/wuzenujelawajam.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460944/normal_5fd27bfd9ca43.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381105/normal_5fab93f0bc7da.pdfIn PDF document text
    • https://taxajefikudo.weebly.com/uploads/1/3/4/7/134765143/luditaxotefut-piluzoxuzo-pudowubovud-kawozibor.pdfIn PDF document text
    • https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/venanamunavibil_fiwimet.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jijumupade/84758751058.pdfIn PDF document text
    • https://s3.amazonaws.com/xoxaneral/benim_hocam_corafya_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/05411d38-61b7-4795-b5f3-5e389985f6de/464461104.pdfIn PDF document text
    • https://s3.amazonaws.com/fonazuzixagizir/ascii_format_database.pdfIn PDF document text
    • https://s3.amazonaws.com/gurafoga/bottom_sheet_dialog_fragment_android.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bab9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBAB9 5132 bytes
SHA-256: 4d0eda850c669330d20e996d4ea8ed4efb5495744e26a34afcd251abef9c2396

Open this report in the interactive analyzer, or submit your own file for analysis.