Malicious PDF — malware analysis report

Static analysis result for SHA-256 1aeaadce60a9d019…

MALICIOUS

PDF

76.3 KB Created: 2021-03-04 14:12:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: cefacb1a4e40fef18f3bf7392101d104 SHA-1: eb1634cd6cccb2dbcdf7a52c2afea03750b71d58 SHA-256: 1aeaadce60a9d0196dbdf384eb2708e7fc8eb2a0a59c48b59d67723fc2b13847
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9696

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=how+to+monitor+gpu+power+consumption PDF link annotation
    • http://kamikofonem.mygamesonline.org/maxurojinolaxonag.pdfIn PDF document text
    • http://setokanekema.mygamesonline.org/does_grey_color_absorb_heat.pdfIn PDF document text
    • http://lixodamevurobar.mygamesonline.org/frigidaire_top_load_washer_error_code_e2.pdfIn PDF document text
    • http://jiteruruw.sportsontheweb.net/romance_sans_paroles_faur_partition.pdfIn PDF document text
    • http://sagedix.medianewsonline.com/new_lg_phones_2020_boost_mobile.pdfIn PDF document text
    • http://falorilipeb.mywebcommunity.org/book_hotel_24_hours.pdfIn PDF document text
    • http://kabuzore.atwebpages.com/xekunalunomerupiliwe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28316a60-d0c2-468b-a932-2734505fb3d3/64693731778.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1c2cff2-3044-4b85-8a75-c771239ebb2e/53259776382.pdfIn PDF document text
    • https://s3.amazonaws.com/sojenozap/25022066436.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/174a0051-5c52-42ba-972b-7347c4e8458c/attack_on_titan_season_3_part_2_opening_full_mp3.pdfIn PDF document text
    • https://3a7b682b-4b85-4b21-836a-a34929c8735b.filesusr.com/ugd/0cd3a8_5e17eaab4f8a4e04b092782c94c3975c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bojafazes/ideal_gas_law_lab_report_physics.pdfIn PDF document text
    • https://1e1f235d-56dd-4976-b20d-d38e3fe7b172.filesusr.com/ugd/210b45_c1bf0e18d3a144e58fe197a0f943cd7f.pdf?index=trueIn PDF document text
    • https://b7af6bb9-01eb-4839-ab56-764651de4344.filesusr.com/ugd/2486b5_9250ba5985384d3b8de76f06788a75ee.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2a4b4e0-0358-43b5-9a1d-65855a264b81/xufiroxepu.pdfIn PDF document text
    • https://e8dc5420-792a-4861-90db-09cfc8d8a7d1.filesusr.com/ugd/1378f5_731c524b70964a38bc55e10315aaaf4b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4ffa6ae-64b0-4988-81d1-aa62bb2868fe/corporate_finance_institute_reddit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b348dc64-c4d0-47cc-bb93-ff929f3a3061/should_i_buy_blink_charging.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5076e6b9-f3fd-42a9-a639-6427f619b598/cuando_fue_domingo_de_ramos_2020.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.