Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e7f41599c19f3ca…

MALICIOUS

PDF

41.4 KB Created: 2021-03-31 07:00:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e1495f0cd3235b52a59be2d03e9be6d9 SHA-1: c0dd617fc5b8a68775a1b6031fcc374996cac1ca SHA-256: 0e7f41599c19f3ca1cba1e08e230daf586b1e16a6a23f8f2ba57462330c5eeb6
84 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical for phishing or malware distribution. It contains multiple external links, including one pointing to 'seumenha.ru', suggesting an attempt to redirect the user to a malicious site. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6647

Heuristics 4

  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 41 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/aws?utm_term=dutch+oven+cookbook+vegetarian
    • http://vufajed.getenjoyment.net/39146050879.pdf
    • http://texewofe.22web.org/android_phone_compared_to_iphone_x.pdf
    • http://relodifalixogo.scienceontheweb.net/garmin_vivofit_3_activity_tracker_white.pdf
    • http://wirobigi.medianewsonline.com/texas_instruments_ti-84_plus_ce_apps.pdf
    • http://giwosoto.sportsontheweb.net/diode_and_zener_diode.pdf
    • http://kugixuxekut.rf.gd/fedobogagogebugo.pdf
    • http://sinusisokopex.atwebpages.com/the_bipolar_ii_disorder_workbook.pdf
    • http://jutesokom.rf.gd/doxirabekazu.pdf
    • http://vekamujibatebig.rf.gd/jurusekazar.pdf
    • https://uploads.strikinglycdn.com/files/7e2107e7-214e-4558-a106-ef0de896b678/polk_magnifi_mini_subwoofer_wont_sync.pdf
    • http://wodedane.rf.gd/36397911415.pdf
    • http://tozemuj.rf.gd/necky_looksha_17_price.pdf
    • https://uploads.strikinglycdn.com/files/4b850462-7924-4513-ab52-ff5b8b93847f/craftsman_6hp_30_gallon_air_compressor_manual.pdf
    • http://zezexobufimorum.epizy.com/michelin_green_guide_egypt.pdf
    • https://uploads.strikinglycdn.com/files/8f0c9deb-d582-427d-86e6-1dbb62909851/51719824312.pdf
    • http://vawapod.rf.gd/xetogajulepefuzabupexiwu.pdf
    • http://numowun.rf.gd/deutschlandkarte_bundeslnder.pdf
    • https://uploads.strikinglycdn.com/files/8033e948-a791-4d20-86b0-367b72ff9b3f/30925693675.pdf
    • http://paguxesij.myartsonline.com/1275498164.pdf
    • http://denuvifateve.epizy.com/stacy_s_mom_parents_guide.pdf
    • http://mezajuwobit.rf.gd/58420359963.pdf
    • http://zogoxuf.atwebpages.com/65928698717.pdf
    • https://uploads.strikinglycdn.com/files/80ac3f19-5978-4eeb-8890-95621da94b4f/99238864574.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.