Malicious PDF — malware analysis report

Static analysis result for SHA-256 142c3ad0371ad7e8…

MALICIOUS

PDF

57.6 KB Created: 2021-03-24 03:27:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a1ec89f39c75c4289dd171aac397ce36 SHA-1: 420b51c52b156a6e1176c6d248e36f5daa62437a SHA-256: 142c3ad0371ad7e8e0ddb943c4693b707673b18d48a3f13ab27e619ad2e55147
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF is identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing lure due to its image-heavy nature and small size. It contains a link farm with numerous external URLs, including a primary suspicious URL, suggesting an attempt to redirect users to malicious content or phishing pages. The heuristic PDF_IMAGE_LURE indicates the document is designed to look like a screenshot, further supporting a deceptive intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8335

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 57 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=onkyo+tx-8160+manual
    • http://help-ruleviolation.com/astro_boy_1980_episode_guideh1rig.pdf
    • http://thepropheticapp.com/garmin_vivosmart_3_bluetooth_issuesvulgt.pdf
    • http://itawegan.space/bill_nye_rocks_and_minerals_worksheetdo1pz.pdf
    • http://idealica-italiaoficial.site/amsco_apush_chapter_13_answershwlr2.pdf
    • http://rixorevu.getenjoyment.net/8212137658.pdf
    • http://theplafond.xyz/discord_nitro_free_crackge5ob.pdf
    • http://xijipeva.mypressonline.com/mv_cable_sizing_calculation.pdf
    • https://uploads.strikinglycdn.com/files/1d1e7f7c-aaf8-40b0-812c-e3bd17b8a5b1/4720356597.pdf
    • https://uploads.strikinglycdn.com/files/81b231e0-a2fa-457c-91df-386da839eeeb/el_desafo_del_amor_40_das_pelcula_completa.pdf
    • https://01ff271a-2d66-4e22-ac0f-a796646d2f56.filesusr.com/ugd/8d93e9_bd8eb0c6bd554719b69186595052dabf.pdf?index=true
    • https://s3.amazonaws.com/fadupazageraf/my_secret_love_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/2816129e-c87c-4659-95a3-ea3e4b473fe4/when_should_you_send_evening_wedding_invitations.pdf
    • https://s3.amazonaws.com/zobuwubedak/54601315722.pdf
    • https://uploads.strikinglycdn.com/files/05d79279-0d3e-4f55-81a8-168f891964d4/dejuxinapovanututiz.pdf
    • https://uploads.strikinglycdn.com/files/7316b961-fdb0-4104-ab4b-42350085938f/which_carolina_herrera_good_girl_perfume_is_the_best.pdf
    • https://s3.amazonaws.com/wupuxus/6967698926.pdf
    • https://6bb2b61b-82bf-473b-8365-63ddb02ddbdd.filesusr.com/ugd/d55797_7a5f034c3fa542799fafb4e0826f792b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/93b1286c-a7ac-454c-b618-539e0678a919/the_hunger_game_part_2_download_in_hindi.pdf
    • https://uploads.strikinglycdn.com/files/f4350bfc-6f63-488c-8f28-2588bfb96c0c/how_to_use_ninja_single_serve_blender.pdf
    • https://uploads.strikinglycdn.com/files/2e82b7b0-3d05-469b-8d91-f0c4f785843a/what_is_the_moral_of_the_story_why_mosquitoes_buzz_in_peoples_ears.pdf
    • https://uploads.strikinglycdn.com/files/2603671f-b22a-471c-b59a-d92990fbe2fc/how_to_reset_a_samsung_dishwasher.pdf
    • https://07d68bf2-0661-47e2-9ffe-eae068a071af.filesusr.com/ugd/fef806_3c65fac2a4d645bf91ad25320c73fb04.pdf?index=true
    • https://s3.amazonaws.com/pipaneku/imperative_form_german_vergessen.pdf
    • https://uploads.strikinglycdn.com/files/a155cfd8-854e-441c-9ca7-c4a740c63f25/98775997593.pdf