Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba10bc8a1f551d2c…

MALICIOUS

PDF

48.0 KB Created: 2020-11-14 05:17:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 9accf1d3c70f45a02aee14eb26700ffe SHA-1: 487441e4b67283243f82f87f439e0a8830a38384 SHA-256: ba10bc8a1f551d2c58933dcd7319e26d19975f9bb7e67063be4bb4be86c89c70
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with at least one identified as a malicious redirector. The ClamAV detection and ML classifier further indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to 'intermediate goods definition', likely to trick users into clicking the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7172

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?utm_term=what+are+intermediate+goods+definition In PDF document text
    • https://cdn-cms.f-static.net/uploads/4387811/normal_5f9ebd0645f8b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386594/normal_5fa9c8b040519.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376856/normal_5f8ac6939ebc1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427077/normal_5fadc4b1cf75c.pdfIn PDF document text
    • https://kekerisasil.weebly.com/uploads/1/3/0/7/130775365/tozaxaf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370561/normal_5f88a9fd1f4c1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402000/normal_5f997809c06b2.pdfIn PDF document text
    • https://lixotesit.weebly.com/uploads/1/3/4/6/134655402/5499021.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372361/normal_5f979478099e7.pdfIn PDF document text
    • https://putigazabikikim.weebly.com/uploads/1/3/2/6/132682718/7886032.pdfIn PDF document text
    • https://togurekeve.weebly.com/uploads/1/3/4/0/134040335/nawefagagatutujuxexe.pdfIn PDF document text
    • https://malalufapavi.weebly.com/uploads/1/3/4/4/134481779/5528792.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387031/normal_5f8efea04f383.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/205dee3b-632d-46e4-8a71-a4c6620549fa/business_law_study_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd764566-458a-4bc4-88a8-3d69c1505633/buvidexodi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1305e267-9265-4d9e-9633-032bc7eaadd4/ziforujun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7da7a64d-09a2-4ace-b908-5f3875fdf3c4/piano_man_sheet_music_free.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.