Malicious PDF — malware analysis report

Static analysis result for SHA-256 02fed4301d416be2…

MALICIOUS

PDF

56.8 KB Created: 2021-06-06 09:40:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 7463946f1cd12ec2527ce8a453e2baa5 SHA-1: 662c44b875187efbdc9e39aa19a2eb95be64350a SHA-256: 02fed4301d416be2d3fc0f06d652033704d5018ad07d8c03be42a4e92bc70298
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, and contains numerous embedded URLs. One prominent URL, https://nomylo.ru/pbw?utm_term=writing+an+argumentative+essay+about+the+nobel+prize+in+literature+edgenuity, suggests a phishing or scam attempt. The PDF structure and embedded links indicate it's designed to redirect users to external, potentially harmful, sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6063

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/pbw?utm_term=writing+an+argumentative+essay+about+the+nobel+prize+in+literature+edgenuity PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4494681/normal_6060fbe2441c9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370307/normal_606cd434e6280.pdfIn PDF document text
    • https://doleposaj.weebly.com/uploads/1/3/4/3/134310894/d61bb5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454990/normal_60090d33737c9.pdfIn PDF document text
    • https://pabenegoje.weebly.com/uploads/1/3/4/3/134348732/jifagigibijirujutab.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426556/normal_5ff86e9265786.pdfIn PDF document text
    • https://junapeborizako.weebly.com/uploads/1/3/4/4/134443413/4647119.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451206/normal_601396f98851c.pdfIn PDF document text
    • https://velineninebag.weebly.com/uploads/1/3/4/6/134608195/ffcb43e73782.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416940/normal_5fdf04844f26b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481662/normal_60183a622d7b3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494440/normal_606d2f055e20b.pdfIn PDF document text
    • https://bonizilolalov.weebly.com/uploads/1/3/4/4/134458774/cb4a41b27c28.pdfIn PDF document text
    • https://fazapezipomen.weebly.com/uploads/1/3/1/4/131453522/7653eaf5b47b.pdfIn PDF document text
    • http://sijomirurefi.pbworks.com/w/file/fetch/144444816/what_is_the_strongest_intermolecular_force_present_in_acetone_ch2o.pdfIn PDF document text
    • http://xorunezagu.pbworks.com/f/arrival_movie_download_in_hindi_dubbed_filmywap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d5ef5ae-974c-4b3a-87aa-a13ebd86ea9b/poulan_2150_chainsaw_replacement_chain.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/090e7029-e574-4bb5-af16-f91d40917deb/45162021160.pdfIn PDF document text
    • http://junerew.pbworks.com/w/file/fetch/144500841/earn_to_die_2_mod_apk_1.3_unlimited_money.pdfIn PDF document text
    • http://botinuba.pbworks.com/w/file/fetch/144414291/g_shock_g7900a_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bea81f40-d379-479a-a9bb-85bbdf026883/64419371783.pdfIn PDF document text
    • http://lopasexosew.pbworks.com/w/file/fetch/144665400/tamil_monthly_calendar_2019_free_download.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.