Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a5f2e35d1b83f1b…

MALICIOUS

PDF

80.0 KB Created: 2021-04-07 05:52:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: b1a0077f2e3c19def4fd3cf44e317f11 SHA-1: 593807a9d21fd9b8077976f322beedd56b7dc8f5 SHA-256: 0a5f2e35d1b83f1bbf7a41483050dd8bb671eda122d086f3ba11d6feb3d2a7b1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, a technique often used for SEO spam or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external PDF links, suggesting a link farm. The ML classifier and ClamAV detection further support its malicious nature. The embedded URL points to a suspicious domain, likely part of the link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7748

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=personajes+mas+importantes+de+la+casa+de+bernarda+alba PDF link annotation
    • https://wazivako.weebly.com/uploads/1/3/0/9/130969042/a3d78575dd8453b.pdfIn PDF document text
    • https://silepokow.weebly.com/uploads/1/3/4/3/134366863/9dde4870e3d3.pdfIn PDF document text
    • http://forijezuxo.22web.org/somopowigu.pdfIn PDF document text
    • https://kipigifusulip.weebly.com/uploads/1/3/4/4/134437712/metagibazisugapa.pdfIn PDF document text
    • https://zoxopabetil.weebly.com/uploads/1/3/1/1/131163737/wugipununuwej-zugutivivu-kogupuwafev-luwix.pdfIn PDF document text
    • https://paxupodef.weebly.com/uploads/1/3/4/7/134763896/memapob.pdfIn PDF document text
    • https://ginufadep.weebly.com/uploads/1/3/4/6/134668932/muvivene_pudopi_supoluwadumila.pdfIn PDF document text
    • https://s3.amazonaws.com/bufexa/mathxl_get_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/febopa/blu_ray_driver_windows_10.pdfIn PDF document text
    • https://s3.amazonaws.com/ropidadegaxut/danenefimefesa.pdfIn PDF document text
    • https://61069a5e-3c5f-4884-a3c7-8c7552058b74.filesusr.com/ugd/0789d5_1d963bd78ce04a9980c3cb5f0dcdabe6.pdf?index=trueIn PDF document text
    • https://f6180879-d31b-499c-8e42-fead7842c491.filesusr.com/ugd/007227_0cc5dcbe0b0948ca87b80cfb9ba7a617.pdf?index=trueIn PDF document text
    • https://36ba0bd5-485c-4bd5-924f-6a5e18dcb854.filesusr.com/ugd/96419b_4664490fc2ee4d8196c5a311e644e4f6.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xutomoxu/22101957138.pdfIn PDF document text
    • http://zuwosopawekaz.rf.gd/aura_libro_carlos_fuentes.pdfIn PDF document text
    • https://s3.amazonaws.com/davawina/kefelipolemudufuzet.pdfIn PDF document text
    • http://sepimenixinu.epizy.com/contorts_the_face_crossword_answer.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.