Malicious PDF — malware analysis report

Static analysis result for SHA-256 305be93b4b6a2d83…

MALICIOUS

PDF

64.0 KB Created: 2021-04-20 07:45:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 0d2e3ed23fdb6f911dee04b570cf7add SHA-1: b79e6054e34db90345d21eead5e2b2e455da76f5 SHA-256: 305be93b4b6a2d835d75c36bd45087c6a4a6ff165da314b9c6591bf0f3b34220
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains multiple embedded URLs pointing to disposable domains, a common tactic for phishing or malware distribution. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a link farm on disposable hosting, and ClamAV detection confirms its malicious nature. The document body, though heavily obfuscated, contains text related to 'B complex tablet used for throat infection', suggesting a lure to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5377

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=b+complex+tablet+used+for+throat+infection PDF link annotation
    • http://noxogejukebe.mypressonline.com/72238211536.pdfIn PDF document text
    • http://paselon.getenjoyment.net/39716406365.pdfIn PDF document text
    • http://fedexonep.mypressonline.com/poduf.pdfIn PDF document text
    • http://tapikival.22web.org/jibopefufexule.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427821/normal_606e84f475811.pdfIn PDF document text
    • http://pornbustyvids.com/mozemetuzikomomn496o.pdfIn PDF document text
    • http://nenodipemuxok.mypressonline.com/all_bike_company_name_list.pdfIn PDF document text
    • http://phtech.site/download_oracle_virtualbox_for_windows_server_2012_r2qdbhu.pdfIn PDF document text
    • http://salestore.pro/high_on_fire_de_vermis_mysteriis_rarb40vf.pdfIn PDF document text
    • http://milesnires.xyz/ajax_uefa_champions_league_winning_history_listodlul.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369657/normal_603d14ab91345.pdfIn PDF document text
    • http://ru-dev.xyz/the_grand_inquisitor_analysis_reddite4g43.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/041dde95-3e65-4bdb-b6da-2dd03362d2ff/3rd_grade_math_books_barnes_and_noble.pdfIn PDF document text
    • http://punejiva.epizy.com/blush_color_formal_shoes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c82acd3c-c643-49cf-b456-edfa4362906c/54908937169.pdfIn PDF document text
    • http://muputuxu.epizy.com/how_many_calories_are_in_a_large_sonic_coke.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f957e6cf-b587-49ae-8edd-cf4ad6010b37/11823839670.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7adbdfc2-f0e2-4b35-af74-d8e21c82a1f0/how_do_you_calculate_exchange_rates.pdfIn PDF document text
    • http://jinufezep.epizy.com/18826476408.pdfIn PDF document text
    • https://s3.amazonaws.com/sobaketemu/62650886921.pdfIn PDF document text
    • https://s3.amazonaws.com/sesijesule/apprendre_a_lire_l_arabe_facilement.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba0cc5ae-207b-4d5f-b35d-d14676a81f20/37678841624.pdfIn PDF document text
    • https://s3.amazonaws.com/sezebepit/dolphin_browser_android_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/dorobukasawituw/equivalencias_entre_unidades_decenas_centenas_y_unidades_de_mil.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.