Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c027828208effaf…

MALICIOUS

PDF

57.6 KB Created: 2021-05-28 20:43:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-24
MD5: 90fd2a2cd0b703f5d1f4faef57b13372 SHA-1: a136ec903ceecffdd6576d2c48b7fa526a93f44a SHA-256: 0c027828208effaf6115e7764db69b50cebbd50adfe9940b111b975ef79a50d5
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier also flag this file as malicious, specifically as a phishing trojan. The embedded URL and the nature of the link farm suggest an attempt to redirect users to malicious or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5491

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=do+you+get+paid+for+training+at+chick+fil+a PDF link annotation
    • https://niwubeleligijoz.weebly.com/uploads/1/3/4/7/134764474/986676.pdfIn PDF document text
    • https://lawejuja.weebly.com/uploads/1/3/0/7/130740077/wamelaso.pdfIn PDF document text
    • https://gisidamuxifa.weebly.com/uploads/1/3/0/7/130775495/7195fd58.pdfIn PDF document text
    • https://volifinidolil.weebly.com/uploads/1/3/0/8/130873876/2030397.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389074/normal_60317b5841980.pdfIn PDF document text
    • https://tovisasuwuvep.weebly.com/uploads/1/3/4/5/134513775/6634795.pdfIn PDF document text
    • https://tewosafaxuw.weebly.com/uploads/1/3/1/3/131379700/8315908.pdfIn PDF document text
    • https://dikubone.weebly.com/uploads/1/3/4/6/134603537/xevubafunaxe.pdfIn PDF document text
    • https://sufewusog.weebly.com/uploads/1/3/4/6/134644796/3168805.pdfIn PDF document text
    • https://dawubatumov.weebly.com/uploads/1/3/4/4/134478144/3e595.pdfIn PDF document text
    • https://nalufubuxozukex.weebly.com/uploads/1/3/4/4/134479837/8718b392da8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471240/normal_601ac0972c2d2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451927/normal_6062cf1d10b04.pdfIn PDF document text
    • https://puxokobipo.weebly.com/uploads/1/3/4/5/134524361/5027681.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501794/normal_6056142d2d4a4.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc12a5c0-1a25-4479-a55f-05e2b7c38813/33848335123.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1284f61-e909-45cd-b0c4-567dd41b9958/kunotasudil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec64a80f-94cf-4d84-a6d7-e180c0c46eaa/how_to_play_super_smash_flash_2_with_a_controller.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c24c6ef1-ab2d-4b77-8f66-e34affd4aadc/zavetibekinomomowosifof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d63dccfd-d0b7-44eb-bf8d-59ccbfa58843/bissell_proheat_2x_pet_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c684fd7c-2998-4e54-84b5-737e881e31cd/can_you_pay_credit_one_over_the_phone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f42a0c34-5c41-45f0-8920-800b09510482/medical_terminology_for_health_professions_8th_edition_book_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32cd6c0b-8da3-4e54-afab-66587d811cf3/how_do_i_clean_my_printer_heads_hp.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/26c0a39f-f080-4345-b485-8c3969623ac1/bakery_business_plan_download.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.