Malicious PDF — malware analysis report

Static analysis result for SHA-256 119d1088363e1216…

MALICIOUS

PDF

65.3 KB Created: 2021-06-03 02:14:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 038af8b1eccd9b4ab83c83143aad093b SHA-1: e9cfd45893b661f75bc128ba868b2fce770ea4c2 SHA-256: 119d1088363e1216ec8de8b503672abc74f4d6499757a6923b613b48ed5e202c
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains heuristics indicating it is a link farm on disposable hosting, with a high ML classifier score and ClamAV detection as Pdf.Phishing.Trojan. The embedded URL, 'https://allytemp.ru/pbw?utm_term=cisco+dna+wireless+ordering+guide', suggests a phishing lure related to Cisco ordering guides. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, consistent with generated documents used in phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6428

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://allytemp.ru/pbw?utm_term=cisco+dna+wireless+ordering+guide PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4389804/normal_5ff112babdfaf.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4482002/normal_60b50d053e3af.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384035/normal_60064fb6b36a7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411931/normal_5fda4b1ce801b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4492278/normal_5ff709b77f121.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418781/normal_6014b09ce4e95.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e89b154-cc60-412c-9023-4cf081a324ef/hp_probook_450_g5_drivers_windows_10_64_bit.pdfIn PDF document text
    • http://feteselulo.pbworks.com/f/74961748468.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b7b8073-d014-463e-a7ce-91bce8436af8/dolatomalupur.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/04ae978e-bd54-4eb0-a9bf-778685a323f1/95730152724.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4544a2e2-e603-4a3e-a893-a8699fd2dfe8/why_has_my_american_eagle_order_not_shipped.pdfIn PDF document text
    • http://pezaloribed.pbworks.com/w/file/fetch/144492147/jaridulelifemujomuromi.pdfIn PDF document text
    • http://wepoline.pbworks.com/f/donde_puedo_descargar_peliculas_de_antonio_aguilar.pdfIn PDF document text
    • http://xoxafepapesu.pbworks.com/w/file/fetch/144411768/mowivar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b2704cd-847d-40a4-9cfb-e44351bed9be/87827651416.pdfIn PDF document text
    • http://xuruzinijub.pbworks.com/f/36049075581.pdfIn PDF document text
    • http://tekitejug.pbworks.com/f/kevin_smith_maths_study_guide_grade_12_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f3f1c0c8-067e-4cb1-993b-cdf50abfd43d/how_do_i_check_my_voicemail_on_my_consumer_cellular_phone.pdfIn PDF document text
    • http://wuxikadafi.pbworks.com/f/mujhse_dosti_karoge_full_movie_with_malay_subtitles_free_download.pdfIn PDF document text
    • http://wuranosa.pbworks.com/f/toro_ss5000_drive_belt_routing.pdfIn PDF document text
    • http://kedetuwi.pbworks.com/w/file/fetch/144427755/converting_km_to_meter_worksheets.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.