Malicious PDF — malware analysis report

Static analysis result for SHA-256 216caf0fdaf725ec…

MALICIOUS

PDF

66.6 KB Created: 2021-04-04 18:50:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5df5647c1cea9300ca3541ad3a72eed4 SHA-1: 8aa87861e55fc45c68c49ebe94ab2e6201b0687b SHA-256: 216caf0fdaf725ec346e06814b2bb4c4875c09319af3594036b41ea1590fb7d2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, with a significant number pointing to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, specifically identified as 'Pdf.Phishing.Trojan'. The document body, though heavily obfuscated, appears to be a lure related to 'Ernest Hemingway quotes meaning' to disguise the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9558

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/aws?utm_term=ernest+hemingway+quotes+meaning
    • http://takafebuxoz.22web.org/wixoworib.pdf
    • http://salleapp.xyz/old_mappila_songs_non_stop_free_downxj1eu.pdf
    • http://taxavifosobedul.iblogger.org/elicitation_techniques_in_teaching.pdf
    • http://pollsexpert.com/7513407315jyz3n.pdf
    • https://cfc603e6-7cd4-4c42-812b-9722deb80ae4.filesusr.com/ugd/0e9fc2_c31375d3d4f94719a62210ad74fe1896.pdf?index=true
    • https://4a0f17ac-6ce6-4c05-9546-25c48d39d9f7.filesusr.com/ugd/cd79e3_f0209e5afeaf426083a9d9474d43657b.pdf?index=true
    • https://58960a86-a3f4-42d8-866e-ee2cf32068b1.filesusr.com/ugd/1ad962_3b34626bbc404bf083e5450e4d945088.pdf?index=true
    • https://f77c8dad-41d7-4a8f-8d8d-c05149a3a236.filesusr.com/ugd/36d413_fb089c65721e4217aa8bb65e399cfe0a.pdf?index=true
    • http://gevuraragide.rf.gd/how_to_buy_stocks_in_pre_market.pdf
    • https://s3.amazonaws.com/tejuvonixag/tatakebulababigego.pdf
    • https://6f847715-c85a-45d9-ae5c-7c68cc800588.filesusr.com/ugd/6e100b_ef98f74e27ea41f09d04bcd8ecdf6168.pdf?index=true
    • https://a1c9bafd-2917-4c1b-b79c-a4b44a941470.filesusr.com/ugd/f0f215_6c6cdfbce84843d9bdb9b85a7dc2b20b.pdf?index=true
    • https://f8b2de7a-6012-4721-b8f1-df5267d6bb95.filesusr.com/ugd/8ebb60_c82e75ef672c4fd69793e2062fb55f76.pdf?index=true
    • http://zegukufezituw.rf.gd/legio_estrangeira_clarice_lispector.pdf
    • https://c301b42c-deab-4116-afcd-a09dd0728425.filesusr.com/ugd/4bb894_32e113e1e71047119fb0ca659c4f1647.pdf?index=true
    • https://4eb83289-b313-4542-b68c-79a1d4783db4.filesusr.com/ugd/f6336d_9c36b17675bb4e2fb3a615c190ec49b7.pdf?index=true
    • https://s3.amazonaws.com/nodetuxapabara/38054817009.pdf
    • https://51956041-da35-40aa-96c1-085c1f47c80d.filesusr.com/ugd/e6e573_20b5396535ad4a1ca28c0da7794b5b2f.pdf?index=true
    • https://1e16da7b-5b4f-4122-a3c4-5c88c9d97cf7.filesusr.com/ugd/83f04e_704f5d270ed64101a5e22db0dd4942f0.pdf?index=true
    • https://493f174a-a540-412c-bacb-e5b7b26cbfcf.filesusr.com/ugd/95bb70_06a3a367c2794d2380420b5c2266af3f.pdf?index=true
    • https://s3.amazonaws.com/vawoginele/azeitona_livro.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.