PDF malware analysis — malicious · 10dd47946bbcc082

MALICIOUS

PDF

63.5 KB Created: 2021-09-17 07:23:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: cf90286b15859033b0fedc719fb98bcc SHA-1: b4cf517087e25b0b23e60aff2ad14fb336d6ddd5 SHA-256: 10dd47946bbcc082f4f20a51b996f8bdda82beaba6538a1891a5f77ec30ed8d4

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs, many of which are part of a link farm on disposable hosting, indicating a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a spearphishing attachment designed to lead users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.7548

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://philabc.ru/uplcv?utm_term=junior+android+developer+cv PDF link annotation
- http://importfoodfair.com/userfiles/image/2021/09/file/75208563494.pdfIn PDF document text
- http://www.infranetltd.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612fa89921c4a---17667653088.pdfIn PDF document text
- http://ksnjl.com/userfiles/files/figemejivikasodumisoj.pdfIn PDF document text
- http://opusbiz.kr/data/editor/file/43279958061374b32aa2b8.pdfIn PDF document text
- http://efcosmetic.com/uploadfile/files/rubavuzetutoxolota.pdfIn PDF document text
- http://lexen.ca/userfiles/files/bawikemanunefuriwitig.pdfIn PDF document text
- http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/efv97von48ptqr8detp4818gg0/50156443234.pdfIn PDF document text
- http://sk-uralstroy.ru/uploads/files/gamuzomegub.pdfIn PDF document text
- https://eownauto.com/uploadpic/files/60597119991.pdfIn PDF document text
- https://mahae.hu/files/files/fepekokas.pdfIn PDF document text
- https://alrukn.co/userfiles/files/zavalunaponupepidu.pdfIn PDF document text
- http://sanarina.de/ckfinder/userfiles/files/83034369057.pdfIn PDF document text
- http://tiendanatacion.com/noticias/files/vewanexizexubinadagurejab.pdfIn PDF document text
- http://mmsmarin.com/imgimage/file/tepabinizo.pdfIn PDF document text
- https://www.bmo-agencement.fr/ckfinder/userfiles/files/48727699927.pdfIn PDF document text
- http://compsult.net/userfiles/file/35712065315.pdfIn PDF document text
- http://houselandia.ru/files/22424192361.pdfIn PDF document text
- http://rsentco.com/upload/file/71854969076.pdfIn PDF document text
- http://markaz-e-durood.com/EditorImages/file/zafigotegoriju.pdfIn PDF document text
- http://montpellier-businessplan.eu/mbp/upload/images/images/upload/ckfinder/vugukobazilurinelatopodo.pdfIn PDF document text
- http://brno-skoleniridicu.cz/ckfinder/userfiles/files/zezefadegaseduwaf.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.