Malicious PDF — malware analysis report

Static analysis result for SHA-256 da5429b739856994…

MALICIOUS

PDF

67.6 KB Created: 2021-01-05 06:44:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b7012c8db376df05766ffe5bbd4e5c2a SHA-1: cb44b8c0babaf13a97f4905db14361235ee66b4c SHA-256: da5429b73985699435df821c45339588f2a6f3667c6afdfdb5e38d9b49aa91bb
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to S3 buckets, suggesting a link farm or distribution mechanism. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically phishing or Trojan delivery. The embedded URL and the heuristic for a 'PDF_SEO_LINK_FARM' point towards an attempt to redirect users to malicious sites, potentially for downloading further payloads or harvesting credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9541

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=alien+shooter+2+game++pc
    • https://cdn.sqhk.co/rusobotakox/gg275b7/bunenenelagaxuxumujane.pdf
    • https://rajerese.weebly.com/uploads/1/3/4/3/134387708/a81f3d3.pdf
    • https://cdn.sqhk.co/silinetufid/Fjahfhd/honda_grass_cutting_machine_service_center.pdf
    • https://cdn.sqhk.co/ligilitojob/iaheoFf/earthquake_emergency_tips.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wurivuve/kexiputup.pdf
    • https://uploads.strikinglycdn.com/files/c7611d01-d1b0-49cc-9415-547b18fc16b8/33288441800.pdf
    • https://s3.amazonaws.com/mukutud/videoder_for_pc_windows_7_free.pdf
    • https://s3.amazonaws.com/degagaziv/36858073858.pdf
    • https://s3.amazonaws.com/zaxawetawupo/movesudevag.pdf
    • https://uploads.strikinglycdn.com/files/f8a69a09-4148-4f0b-aa31-00e5dd358391/37016575243.pdf
    • https://s3.amazonaws.com/fonibinaraj/letter_of_accommodation_example.pdf
    • https://uploads.strikinglycdn.com/files/3280c0a5-004e-4c16-917d-02aed6c93b9a/91360386872.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3d2.bin
718546d115e70ff0951f8bdb588dbfa632c1d14eb83eb0eb8194f26cecf6af72		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3D2 5256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.