Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a52631033bc5d85…

MALICIOUS

PDF

65.1 KB Created: 2021-06-09 19:06:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 459573e232a312a2e18f95af043e7d5e SHA-1: 7ea89092a0062a9f38d914511bd5bf8b7eaf6196 SHA-256: 2a52631033bc5d85d95d5a15c0369e006ee46cc78dc3e8ca82dc4d1dcef77004
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5247

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/pbw?utm_term=motivation+letter+for+mba PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4416140/normal_5febb67a8da52.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486199/normal_60bc91b43688e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367940/normal_60421ad0b558d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464700/normal_5fde439e8db66.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417319/normal_6058705935152.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475719/normal_60321d35c3e67.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417643/normal_602458d0d337d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470385/normal_600ff561831a5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366957/normal_60b9b2488dc72.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458132/normal_6040bbde1bc54.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471106/normal_6003db94ce8fc.pdfIn PDF document text
    • http://lagawiwefe.pbworks.com/w/file/fetch/144881160/ielts_academic_reading_practice_test_with_answers_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00287b96-cfd2-466c-9c70-1dd8c50fdc22/bikurilabovupenole.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4508c08e-2edb-44e6-ac0a-7a785f26a60b/nenabikoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c1696db-d69f-4d8a-be9c-27877081ac2c/peter_principle_book.pdfIn PDF document text
    • http://pubetejidewi.pbworks.com/f/23188229023.pdfIn PDF document text
    • http://rizukokodi.pbworks.com/w/file/fetch/144910650/82570139615.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce90f828-293c-4bc3-813f-6a1362813592/patawom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e55e0f96-b183-4470-96bc-d1e5b993f6c9/volume_booster_iphone_6.pdfIn PDF document text
    • http://zuwuzemoj.pbworks.com/w/file/fetch/144801234/pafarorutizaxarapid.pdfIn PDF document text
    • http://moxulolo.pbworks.com/w/file/fetch/144671619/fixed_asset_depreciation_schedule_excel_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/782b8d36-f968-4653-9909-432b155987bc/duck_life_2_hacked_unblocked_no_flash.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e179cbe-5f02-46c3-baab-386287460843/best_tig_welder_for_beginner_uk.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.