Malicious PDF — malware analysis report

Static analysis result for SHA-256 14e8c0965b4bd5e7…

MALICIOUS

PDF

54.5 KB Created: 2021-03-27 14:12:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b1c547cd4555bb6feb4e5b9930c21af4 SHA-1: 96668d8a16692fa3622770a17e6bca9390bf307a SHA-256: 14e8c0965b4bd5e7b28a163581d3f8a7d890449007c74b453e95aa0792106e4d
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a malicious phishing lure due to its small size, image-only content, and embedded clickable link. The heuristic PDF_IMAGE_LURE indicates a common phishing tactic where a screenshot is used to hide an action trigger. The PDF_SEO_LINK_FARM heuristic suggests the document is part of a larger network of SEO-optimized malicious PDFs, likely designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6477

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 54 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=transport+company+profile+sample+pdf
    • https://lajutiruwogow.weebly.com/uploads/1/3/4/5/134585316/33d530.pdf
    • http://montana-media.com/livovevoqojec.pdf
    • http://beruvutekimeged.22web.org/how_to_write_a_great_short_story_-_the_8-point_story_arc.pdf
    • http://erogan-encolumbia.site/26399808480po6hx.pdf
    • http://love-your-lips.online/chuunibyou_demo_koi_ga_shitai_tp_11vfnak.pdf
    • http://sosed.market/wizosibevorezetufelepofu2jbkl.pdf
    • http://chambrely.xyz/36965489174lc044.pdf
    • http://jakor.pro/five_nights_at_freddys_5_unblocked_games_663505w.pdf
    • https://vubeluzuge.weebly.com/uploads/1/3/4/3/134357782/34d41a36b4.pdf
    • http://tejaberi.iblogger.org/nawide.pdf
    • https://jakipafowikodo.weebly.com/uploads/1/3/1/0/131070805/bexarivize.pdf
    • http://nakosaf.rf.gd/what_is_sugar_on_nutrition_label.pdf
    • http://poxatita.epizy.com/approaches_to_psychology_glassman.pdf
    • https://8c4778c4-ed17-4cf1-86f9-5448e21c5c15.filesusr.com/ugd/6da380_42f4dddf0dc440409cd4ab9499e7b7f2.pdf?index=true
    • https://09235f31-469a-4613-94fc-36d04c1f642a.filesusr.com/ugd/8b6407_cfeb1508f0fb405ba1df31c50688835f.pdf?index=true
    • https://cda84be5-0c54-4c05-8389-97bb004c798d.filesusr.com/ugd/fa9f00_2e7e2689e3324bc6a3db10661839eead.pdf?index=true
    • http://xuxuparozit.epizy.com/sedezokidab.pdf
    • http://zuxamivim.epizy.com/raglan_shirt_template_vector.pdf
    • http://ratotepuno.rf.gd/56867827016.pdf
    • http://nixutatafodozof.epizy.com/present_simple_present_continuous_exercises_primary.pdf
    • https://ef5e9b3f-1a8e-4c79-9b60-34b8f8133c96.filesusr.com/ugd/18574e_faaace1fe49241e2a58ddef509c7bf39.pdf?index=true

Open this report in the interactive analyzer, or submit your own file for analysis.