Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f61659e53a7c5dd…

MALICIOUS

PDF

41.8 KB Created: 2021-03-25 15:37:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-28
MD5: ed10633dffa6e33b50248abb072053b3 SHA-1: a78dec28a0f32fa63487d2c2ea5e0e84b2287c1f SHA-256: 1f61659e53a7c5dd365ab24ae13035da3b36a32f8fe7b58b4db47805f499b2a1
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF is identified as a phishing lure due to its image-only nature and embedded clickable link. The heuristic 'PDF_IMAGE_LURE' indicates it's designed to trick users into clicking an external URL. The presence of multiple URLs hosted on disposable domains, as flagged by 'PDF_SEO_DISPOSABLE_LINK_FARM', further supports a malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6423

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 41 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=wood+jewelry+box+plans+pdf PDF link annotation
    • http://ig-soft-team.com/tenujava4g5p6.pdfIn PDF document text
    • http://gnoogle.site/53906474217gboxz.pdfIn PDF document text
    • https://vumorusumanipav.weebly.com/uploads/1/3/4/2/134234742/3fd14d4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472793/normal_600c5163d30cf.pdfIn PDF document text
    • http://mexicotop3.xyz/ferrite_loop_antennaow26y.pdfIn PDF document text
    • http://mowefopovog.mywebcommunity.org/il_cantico_delle_creature_branduardi.pdfIn PDF document text
    • http://mozujana.22web.org/17281891699.pdfIn PDF document text
    • http://gayerkan.com/64715416442nq8pr.pdfIn PDF document text
    • https://bejutenexej.weebly.com/uploads/1/3/3/9/133997629/19bbb60b4d23da.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461205/normal_600364bf56df9.pdfIn PDF document text
    • http://pejazadajenatew.getenjoyment.net/pefejigaseni.pdfIn PDF document text
    • https://mefevujeloz.weebly.com/uploads/1/3/4/3/134317202/vimiletimotofogafo.pdfIn PDF document text
    • https://burerekubexu.weebly.com/uploads/1/3/1/3/131381452/5951250.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384304/normal_604aa5049aa76.pdfIn PDF document text
    • https://papobujiwirila.weebly.com/uploads/1/3/1/4/131453114/fukakoseki-bifos-jiloxexu.pdfIn PDF document text
    • http://bafedudovodamo.medianewsonline.com/peledubisesisemeba.pdfIn PDF document text
    • http://chunyoo.com/graco_milestone_all-in-one_car_seat_costcoxd4ni.pdfIn PDF document text
    • http://miloxirabufa.epizy.com/11980283135.pdfIn PDF document text
    • http://gizimup.epizy.com/ancient_celts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38bb4bd1-927d-4366-b452-4172b86e54b1/nulure.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1a3bac3-e74b-476e-92ce-ca5d144a55ba/66630317884.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/740df20c-a41c-465c-a502-26d754c023d0/myles_munroe_teachings.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a3be4c6-bad6-4e98-8280-71346b943aa6/32821645768.pdfIn PDF document text
    • http://waxusumuguk.epizy.com/french_english_bilingual_visual_dictionary.pdfIn PDF document text
    • http://togipabuwaf.epizy.com/sears_sewing_machine_tables.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ee7fa1c-5f37-46cc-b601-84e165b68026/sabakulo.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.