PDF malware analysis — malicious · 283930c3145dc84f

MALICIOUS

PDF

44.9 KB Created: 2021-03-12 13:16:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 66eee65978baa0b98f9627c14b07acf3 SHA-1: 23927609f1c424a29f4ef3a56053b918f8ea6aaf SHA-256: 283930c3145dc84f88cb362a0e034ef7b11b561625396cd0e20d06719c21d6f0

144 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical for phishing campaigns. It contains numerous embedded URLs, many pointing to disposable domains, suggesting a link farm designed to obscure the final malicious destination. The ClamAV detection and ML classifier further support its malicious nature, likely serving as a dropper or redirector to a phishing site.

Machine Learning

Nyx PDF Classifier malicious score 0.8132

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 44 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dugedepap.ru/award?keyword=adelaide+high+school+zone+pdf
- http://widonatozeg.mypressonline.com/converter_para_musicxml_online.pdf
- http://bitjoms.xyz/61125569129d6ag5.pdf
- http://kojazunupetip.mygamesonline.org/lozetunajolotatajulibi.pdf
- http://eurosett.net/52477599012u3t2l.pdf
- http://politach.com/xozafinopugusimufes0lc4.pdf
- http://bibivire.mygamesonline.org/what_does_credit_terms_2_10_n_30_mean.pdf
- http://gejikojaki.scienceontheweb.net/bangla_book.pdf
- http://xalenupom.getenjoyment.net/how_to_do_a_data_analysis_in_excel.pdf
- http://bovibuvebus.getenjoyment.net/wijowebadibifezelibafuk.pdf
- http://sodowetan.mywebcommunity.org/how_to_generate_seller_leads_in_real_estate.pdf
- http://vexabimumemig.atwebpages.com/how_to_write_a_purpose_statement_for_a_lab_report.pdf
- http://bixozebaxikapos.atwebpages.com/analog_and_digital_signals_and_systems.pdf
- http://gujimosodaza.myartsonline.com/art_history_volume_2_5th_edition_free.pdf
- https://87b84290-c0b3-4c73-97a1-3d59c64c3f69.filesusr.com/ugd/c638b7_17274904e6c54e85b09a78b62fbc5e1d.pdf?index=true
- http://saxodanokijaj.atwebpages.com/online_project_management_training_programs.pdf
- https://67dec473-0a9c-497c-80b1-62a4c84c5046.filesusr.com/ugd/0aab01_b15737573431446eb4d5a576a25d5e55.pdf?index=true
- https://fac30f9c-1bc3-4ff6-ac40-7ced1d2a170b.filesusr.com/ugd/3b7182_1abbed44c4dd4cdba41f78ff62e1df56.pdf?index=true
- https://uploads.strikinglycdn.com/files/acdd4899-d25d-4e7e-818a-13169a8f1e23/pudexeteki.pdf
- https://uploads.strikinglycdn.com/files/68ae2f4c-3b9f-4273-8196-331134fb1bd9/not_my_cup_of_tea_similar_phrases.pdf
- http://gixarewujedel.atwebpages.com/caricatura_politica_del_porfiriato.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.