PDF malware analysis — malicious · 2c5252b0481cfd7e

MALICIOUS

PDF

54.3 KB Created: 2021-03-12 02:53:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5f1ac783100186c647ac127a6170e064 SHA-1: 2b993e15e8d4cd03a0b4f5cddfc164ec5ecb58c8 SHA-256: 2c5252b0481cfd7eaad5dcc7442364172e502d8d01b8c5986f878fa2ec7b9c5c

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document is identified as a phishing lure due to its small size and image-only content, typical of a screenshot designed to trick users into clicking an embedded link. The document contains numerous external links, many of which point to PDF files hosted on various platforms, suggesting a link farm or a distribution mechanism for malicious content. The primary malicious URL identified is https://gimoguvi.ru/award?keyword=international+ring+sizes+pdf.

Machine Learning

Nyx PDF Classifier malicious score 0.5927

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 54 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gimoguvi.ru/award?keyword=international+ring+sizes+pdf
- https://revekabidumuki.weebly.com/uploads/1/3/2/7/132710675/ecbc0a.pdf
- https://bunevozobete.weebly.com/uploads/1/3/4/7/134714888/079fd20de09.pdf
- https://karozazosepi.weebly.com/uploads/1/3/4/3/134316788/tefaxegifobaka.pdf
- https://jiditejebata.weebly.com/uploads/1/3/5/3/135305220/8161a.pdf
- https://ralufuluwifo.weebly.com/uploads/1/3/0/9/130969066/3601372.pdf
- https://buzoraxuv.weebly.com/uploads/1/3/4/3/134366179/070bd4c3.pdf
- https://xutobegepoxebax.weebly.com/uploads/1/3/5/3/135333125/napeveg-poximawotifedod.pdf
- https://sadavixiji.weebly.com/uploads/1/3/5/3/135333995/f561ee59589a.pdf
- http://kulibakux.iblogger.org/how_to_get_rid_of_a_callus_under_my_foot.pdf
- https://6997f972-013f-4c6f-ac95-4179ba17a557.filesusr.com/ugd/549e1a_1ebb92bfa0da4259aa644db051a6bf2a.pdf?index=true
- http://furamexexi.rf.gd/icamera_1000_adt.pdf
- https://s3.amazonaws.com/liwafo/topic_sentence_and_supporting_details_ppt.pdf
- https://1ceef7f3-d523-4f80-a0a4-3aed54d3d17a.filesusr.com/ugd/48841a_265f537e3b054ef8879ac404b35a57ba.pdf?index=true
- https://59b7e61f-9850-45ee-add2-e9646db267e4.filesusr.com/ugd/5b9365_f2b6972fa9d64f7489560c39f00f282e.pdf?index=true
- https://s3.amazonaws.com/jinabom/kadade.pdf
- https://e57d8632-f742-4524-ada6-9cdf759d9f13.filesusr.com/ugd/b0cb2d_7085f88e7c1b401fb2bda491e3e5e4db.pdf?index=true
- https://s3.amazonaws.com/ribowexulo/bivubufibojitomika.pdf
- https://s3.amazonaws.com/dudigonifu/78102437696.pdf
- https://s3.amazonaws.com/sonutopexaramuf/conventional_non_occupant_co_borrower_guidelines.pdf
- http://kizofenumuvuma.epizy.com/politik_pemerintahan_amerika_serikat.pdf
- https://s3.amazonaws.com/pidufozu/zogapusubefuvukurured.pdf
- http://xusoloturokuk.epizy.com/equilibrium_constant_lab_answers.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.