Malicious PDF — malware analysis report

Static analysis result for SHA-256 d17a40bd835fb88d…

MALICIOUS

PDF

49.8 KB Created: 2020-12-23 12:04:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 20d17eac71dd0f25bde83a7ca6dd8e8d SHA-1: d6d47b2e6b553afa6261b7c9653e5d67736302dd SHA-256: d17a40bd835fb88dd38c31c0251173176479f9c82ab777b9a579995962fe5703
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical for phishing or malware distribution. It contains numerous external links, including one pointing to 'traffine.ru', suggesting an attempt to redirect the user to a malicious site. The ClamAV detection and ML classifier further support its malicious nature, indicating it's likely a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8783

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 49 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=witcher+3+endings+reddit
    • https://nadunetuvopalo.weebly.com/uploads/1/3/4/8/134884029/4671254.pdf
    • https://pafegesufo.weebly.com/uploads/1/3/4/7/134719460/budovisi_livipimumamaked.pdf
    • https://faviretekomukuf.weebly.com/uploads/1/3/4/6/134606805/mirekoduw.pdf
    • https://papunagaku.weebly.com/uploads/1/3/1/3/131384156/9526788.pdf
    • https://uploads.strikinglycdn.com/files/afb2fafa-d611-4f34-b056-5bb5c1072107/song_lyrics_quiz_and_answers_2018.pdf
    • https://uploads.strikinglycdn.com/files/302a4687-9675-45d7-8fb7-2c4d2fa7e601/rerezelomobodemikevef.pdf
    • https://uploads.strikinglycdn.com/files/4c71c829-4d7c-41ff-a332-2f0bb0a6ac01/80349760443.pdf
    • https://uploads.strikinglycdn.com/files/484b6930-7332-485f-8aec-fe660640f6fa/35892502992.pdf
    • https://uploads.strikinglycdn.com/files/8e4b4963-4114-44a9-aefc-fe06fd533fbc/wow_classic_summoning_stones_not_working.pdf
    • https://uploads.strikinglycdn.com/files/4813dd09-3a36-4bf2-8a1f-62b708f80052/dizisipigivexunedimoju.pdf
    • https://uploads.strikinglycdn.com/files/0bfdf335-0310-496f-bb5f-d1d455c5ab4e/sago_mini_superhero_games.pdf
    • https://uploads.strikinglycdn.com/files/bb967d84-a944-47e6-b1fd-deb750d9b669/ex_love_back_astrologer_in_mumbai.pdf
    • https://uploads.strikinglycdn.com/files/a8701a5e-d341-4593-b42c-84ff1d10d4b5/patricia_kennealy_morrison_latest_interview.pdf
    • https://uploads.strikinglycdn.com/files/49d7bb7e-6bb5-4a1e-965e-6501cabc96cf/folozatekivimofem.pdf
    • https://uploads.strikinglycdn.com/files/aa4db0de-bcd6-4d37-aec5-7d38f34912c0/78328295430.pdf
    • https://uploads.strikinglycdn.com/files/54bba487-4645-4f02-8f25-898a02032585/heather_hills_pool.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.