Malicious PDF — malware analysis report

Static analysis result for SHA-256 008eff0195cd7c12…

MALICIOUS

PDF

58.6 KB Created: 2021-03-06 12:45:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: afde824161943eefea773ab41a416842 SHA-1: b478ef895e936f1801c84edd3077591dae638acc SHA-256: 008eff0195cd7c1226209ad284520cf674de328535ab793a0bf42c015a0ae7ea
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6478

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=the+river+radio+station+front+royal+va PDF link annotation
    • http://lnstagramverifiedbadge-media.com/from_third_world_to_first_ebook_free_download6v4kf.pdfIn PDF document text
    • http://beremoter.online/recommendation_letter_for_masters_scholarshipm28qi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411001/normal_5fe4f6af5333e.pdfIn PDF document text
    • http://cardioactiveufficiale.site/kevutuduvoxivewj90zc.pdfIn PDF document text
    • http://cardio-active.site/edelweiss_guitar_chordsv9idx.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408483/normal_5fe5270f938b6.pdfIn PDF document text
    • https://s3.amazonaws.com/sizabo/31854153325.pdfIn PDF document text
    • https://s3.amazonaws.com/mukut/assignment_format_university.pdfIn PDF document text
    • https://42cc6f6d-9125-48bc-bce4-1bf15f49b1be.filesusr.com/ugd/7c30af_fe30ccede033450d97cc3e62becca605.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/72515586778.pdfIn PDF document text
    • https://s3.amazonaws.com/muwemivumazulax/sovadi.pdfIn PDF document text
    • https://s3.amazonaws.com/poguvelefa/74892907819.pdfIn PDF document text
    • https://777dd155-384c-4f1d-a337-8f27b94bb056.filesusr.com/ugd/1ecdae_8054f4f8354b4c65b55679bf9184a901.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dotivaf/michelin_star_guidelines.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8ed3eed-2625-448c-a745-a88097d89a38/78866703649.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/614947bc-5935-4056-bb3a-fbcbe57d9fb8/tp_link_n750_factory_reset.pdfIn PDF document text
    • https://s3.amazonaws.com/sumesawoxajew/easl_clinical_practice_guidelines_hcc.pdfIn PDF document text
    • https://s3.amazonaws.com/rodakarugupoko/boy_scout_office_midland_tx.pdfIn PDF document text
    • https://s3.amazonaws.com/zoromexemuzid/puxonolivepopifotikakibo.pdfIn PDF document text
    • https://s3.amazonaws.com/redegelesibif/sociology_noun.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.