PDF malware analysis — malicious · faba7f5e6a4a6356

MALICIOUS

PDF

67.6 KB Created: 2020-11-13 04:34:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27

MD5: cdee2d93d1fdb3e2015a746eb94a2e51 SHA-1: 36b3e479d9ced6a8f6a05d4be6e93a192483f176 SHA-256: faba7f5e6a4a6356b64f90145dafd89da7ef83776a270a35110ad08fbcfa784f

212 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links pointing to external PDF files, indicating a link farm or SEO manipulation tactic. One of the primary links directs to a known malicious redirector. The ClamAV detection and ML classifier further support the malicious nature of this document, classifying it as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9705

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/aws?utm_term=what+is+surge+arrester+for+transformer In PDF document text
- https://zoludapi.weebly.com/uploads/1/3/4/5/134528767/sebozug.pdfIn PDF document text
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/6143103.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370530/normal_5f8a0f6088275.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366317/normal_5f873ff754b22.pdfIn PDF document text
- https://vagonegasix.weebly.com/uploads/1/3/1/4/131482995/5511052.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4423155/normal_5f9cd1ff88f05.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421350/normal_5faa85612c765.pdfIn PDF document text
- https://lonunibulitog.weebly.com/uploads/1/3/4/4/134498578/vewik.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373259/normal_5f88f71767919.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/salosibejodod/culinarian_desynthesis_guide_ffxiv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/94d0433b-d90b-40ab-a4fc-18053c607e5b/fnaf_4_free_apk.pdfIn PDF document text
- https://s3.amazonaws.com/varolexexus/minecraft_apk_latest_version.pdfIn PDF document text
- https://s3.amazonaws.com/zedilegol/star_wars_battlefront_2_cheats_xbox_360.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/24633e84-42f4-418e-b680-5e55419538ec/sefulexewoforenifukix.pdfIn PDF document text
- https://s3.amazonaws.com/baxunaf/oracion_poderosa_al_padre_eterno.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fc31.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFC31	5044 bytes
SHA-256: `c5ce587c87539adbabd4804693ecb46f9c9b9f876528f8e8b98517081db48884`

Open this report in the interactive analyzer, or submit your own file for analysis.