Malicious PDF — malware analysis report

Static analysis result for SHA-256 f845159063a015f5…

MALICIOUS

PDF

72.3 KB Created: 2020-12-20 23:11:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 90e0b9372ff03aab5471ffca3ac2d8c9 SHA-1: edf49cf6ced907795e7b689915635cbe5e473aa6 SHA-256: f845159063a015f50420fc7088df7596e1b25c997825ca25dff819c3c5201fa4
252 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, many pointing to redirectors and SEO link farms, indicating a phishing or scam attempt. The primary lure appears to be a 'Lenovo chromebook duet 128gb 2- in- 1' which redirects to a malicious URL. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9344

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=lenovo+chromebook+duet+128gb+2-+in-+1 In PDF document text
    • https://static.s123-cdn-static.com/uploads/4447273/normal_5fdccf01bf807.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365646/normal_5f97fc8f73ba0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369933/normal_5f94472ce5bfd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388824/normal_5f9585c7153ac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494648/normal_5fd80d6eab641.pdfIn PDF document text
    • https://katibaluzopoxu.weebly.com/uploads/1/3/0/7/130738884/559341.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487191/normal_5fb561e963b52.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454977/normal_5fc1f357cac09.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wejuvono/81954588499.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/daf46fa0-6e79-459b-bbfc-746ac1b5a98c/kudovireterug.pdfIn PDF document text
    • https://s3.amazonaws.com/juxatop/tragic_flaw_definition_and_examples_in_literature.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e00b5db-d005-4b7e-b9e1-becb8727b74b/ampeg_ba_210_schematic.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21515937-6ee2-4edd-b9cf-8c3d6ad798ec/how_to_find_class_boundaries_statistics.pdfIn PDF document text
    • https://s3.amazonaws.com/bojafazes/eternal_city_conquer_wielder_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fdabbea-6abd-48ff-b327-5a592805bb5a/8412702728.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1B6 5432 bytes
SHA-256: 075ad54c529800af6463b2c9038b8a7238f72f082c7c6980fa85f338a11a5ccc
font_01_sfnt_off0000f417.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF417 11104 bytes
SHA-256: 7478e70cb976e1042a1157a0f032c10d92669d8aa1eb2ceac8d2f9dfb3398009

Open this report in the interactive analyzer, or submit your own file for analysis.