Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c0cafc2e0d5487b…

MALICIOUS

PDF

40.7 KB Created: 2021-06-06 09:53:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: c7af6c9c4cd651f94ce80790240cfd06 SHA-1: c70e4451f02cdedbe60a231456280c7f677734a3 SHA-256: 1c0cafc2e0d5487ba0cc2bfb914daf4cbd18703404184aaa2ba040d1ebd13296
204 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and uses an image-based lure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8524

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 40 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/pbw?utm_term=linear+equations+exercises+pdf PDF link annotation
    • https://mamifonor.weebly.com/uploads/1/3/1/1/131163935/7060420.pdfIn PDF document text
    • https://pewatusikowago.weebly.com/uploads/1/3/2/6/132683224/57585d94.pdfIn PDF document text
    • https://gotumofavi.weebly.com/uploads/1/3/4/6/134602885/2cfec0.pdfIn PDF document text
    • https://bigorofepomibed.weebly.com/uploads/1/3/4/4/134400252/9d39e9dfdbb251d.pdfIn PDF document text
    • https://milanabez.weebly.com/uploads/1/3/2/6/132695465/badelopeva-pukere-zirejo-kugodatikidor.pdfIn PDF document text
    • https://zavitakeji.weebly.com/uploads/1/3/4/9/134904790/xibosemolum-xebifeb-samapu-mesipanepubuni.pdfIn PDF document text
    • https://tulosiwawi.weebly.com/uploads/1/3/5/3/135326734/0f02441.pdfIn PDF document text
    • https://kanapikimafu.weebly.com/uploads/1/3/3/9/133997195/3016a.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd9ee1d9-1083-41f1-a595-c4c62f05f20c/kisebevobip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e07cd6a4-4ab0-41af-aebf-54d72e2dc18e/93279634799.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/129e1f9c-e965-4aa1-8df2-072b228763c2/corte_de_espinhos_e_rosas_google_drive.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/94b2394c-309d-4778-b7e0-92381d052248/83084701501.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ff858c8-8a23-4970-ac8d-448874e322e1/65341046931.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa2a7be5-fdec-43d9-b8e5-ca45c8eb86d8/rijoxokepob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21071cf0-8844-4d72-b925-68fa05df1024/kalipefurujazutegutoxe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f470c3bd-ba77-40f2-b510-f7a1131b7bf3/vatelapubez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24e14ef4-daa4-43b8-afb1-1f9df61167c5/pularujowumuji.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e1fd36d-d307-484d-be5f-e43697d4629a/bujojejomopok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/12315be4-c884-444e-aef6-ca75b6711302/how_to_do_cheer_jumps_for_beginners.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.