Malicious PDF — malware analysis report

Static analysis result for SHA-256 2cbd7866f52017f1…

MALICIOUS

PDF

92.6 KB Created: 2021-03-24 16:34:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: cf17a939fc928eff48fd60af1554e8a3 SHA-1: cca674ecec75c9181eac2bb49302079ce82fd639 SHA-256: 2cbd7866f52017f187549ba1d6fbde1757530ce310725c00c41c45e8afbf1da3
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8962

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/aws?utm_term=diablo+2+best+runewords+for+necromancer PDF link annotation
    • https://cdn.sqhk.co/zunesunatiri/zijhjcc/rockauto_promo_code_november_2020.pdfIn PDF document text
    • http://lixorajepidil.mygamesonline.org/f_table_0.05.pdfIn PDF document text
    • http://silekutum.medianewsonline.com/what_age_rating_is_world_war_z_2.pdfIn PDF document text
    • http://zuxupesoxitiru.22web.org/is_the_subaru_impreza_a_reliable_car.pdfIn PDF document text
    • http://lagidonak.mygamesonline.org/sunidurubizozurexomekoxal.pdfIn PDF document text
    • https://cdn.sqhk.co/lilomovetum/4icchiA/wanezo.pdfIn PDF document text
    • http://xafesuvorolivig.scienceontheweb.net/contoh_amdal_pabrik.pdfIn PDF document text
    • https://cdn.sqhk.co/xovikojux/23yibdG/ricetta_omelette_salate_prosciutto_e_formaggio.pdfIn PDF document text
    • http://duwinijuj.mypressonline.com/22718557197.pdfIn PDF document text
    • http://rakapugijumub.sportsontheweb.net/75617057217.pdfIn PDF document text
    • http://dasezin.getenjoyment.net/where_is_the_stand_being_filmed.pdfIn PDF document text
    • http://ninomut.sportsontheweb.net/moral_leadership_definition.pdfIn PDF document text
    • http://sipanokule.onlinewebshop.net/pujokopofiwigesumin.pdfIn PDF document text
    • https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_80dd6b0f4d314a49b48c50d56dea8021.pdf?index=trueIn PDF document text
    • http://xikebivulusures.rf.gd/8044067464.pdfIn PDF document text
    • https://315736c7-1030-4200-8d24-05c9f4951019.filesusr.com/ugd/d19ca0_67e456d9ed9c485691362e0a30b9ef95.pdf?index=trueIn PDF document text
    • http://viniwowosur.onlinewebshop.net/why_does_it_hurt_to_look_up_at_the_sky.pdfIn PDF document text
    • http://witefuru.rf.gd/blaze_pizza_nutrition_guide.pdfIn PDF document text
    • https://8eeb1f0a-0cdd-4c66-98a4-83777b49fb54.filesusr.com/ugd/64f9d2_ebfaf8ecb6e844949c80b64202e24a53.pdf?index=trueIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.