PDF malware analysis — malicious · 1aa156ab586511bc

MALICIOUS

PDF

61.3 KB Created: 2021-03-23 05:06:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ae1a277cc756bc4f576c1e5489ccc315 SHA-1: 7b9f82be2f266d85c13754a7fcfc0ee631200a33 SHA-256: 1aa156ab586511bc8d4f8700f9b5fbd4c474e71339ff1d9e5b06d73e928b4d03

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical of phishing campaigns, which directs users to a suspicious URL. The ClamAV detection and ML classifier further indicate malicious intent. The document's structure and embedded URLs suggest it's part of a link farm designed to redirect users to potentially malicious content, likely for credential harvesting or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.8706

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 61 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xajibur.ru/award?keyword=decision+making+and+problem+solving+pdf+ias
- https://lobovalosidim.weebly.com/uploads/1/3/1/4/131437181/kilomirixegisaresu.pdf
- https://vobudogekatobef.weebly.com/uploads/1/3/0/8/130874620/wenawuwi-vanonogekusogen-dozibonosu-gadezepokin.pdf
- https://furamakivagoj.weebly.com/uploads/1/3/0/8/130814247/4751074.pdf
- https://besajiti.weebly.com/uploads/1/3/1/8/131856076/japexewuvupo_kuvezuxev_gemuregivu.pdf
- http://mawabubobiniz.rf.gd/83975417396.pdf
- https://s3.amazonaws.com/kizugokofo/toyota_camry_seat_covers_walmart.pdf
- https://s3.amazonaws.com/lemefofutomapox/android_auto_mazda_cx3_2017.pdf
- https://s3.amazonaws.com/setaxilitozuko/lapilopataleto.pdf
- http://puwomuf.rf.gd/bose_qc35_ii_firmware.pdf
- https://s3.amazonaws.com/wakuzidi/dark_souls_3_dlc_walkthrough.pdf
- https://uploads.strikinglycdn.com/files/30c70ab1-b946-4b41-8672-588ba9fed3a9/how_to_test_gm_oil_pressure_sensor.pdf
- https://s3.amazonaws.com/dazinibonofobi/best_family_calendar_app_for_android.pdf
- https://s3.amazonaws.com/midipes/xezegatupedosemapetirap.pdf
- https://uploads.strikinglycdn.com/files/82624297-566c-437f-8c20-0ba79651b9fd/zapixusupik.pdf
- https://s3.amazonaws.com/gadumagabusodel/manual_qa_analyst_jobs_near_me.pdf
- http://xakarukuneki.rf.gd/kozukikosefuvi.pdf
- http://natunolujekusi.epizy.com/ruzukojegexani.pdf
- https://s3.amazonaws.com/fefurorobumi/scienze_degli_studi_umanistici_e_della_formazione.pdf
- https://uploads.strikinglycdn.com/files/0791b1c0-6857-4262-9297-e84a3b8efead/what_are_the_trending_songs_right_now.pdf
- https://s3.amazonaws.com/foneniz/avadh_university_ma_private_form_online.pdf
- https://uploads.strikinglycdn.com/files/bb9a43f8-2171-4cdb-bed6-93bee086d3d0/tone_of_poem_if_i_were_lord_of_tartary.pdf
- https://s3.amazonaws.com/jajuzasalikirut/ap_biology_chapter_24_easy_notecards.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.