Malicious PDF — malware analysis report

Static analysis result for SHA-256 31c18f97439b6336…

MALICIOUS

PDF

47.5 KB Created: 2021-03-28 02:31:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 13de710e77593e62c0371afe82ffe988 SHA-1: 790a6107fbb104f9752416b509bf7e337ec45be0 SHA-256: 31c18f97439b6336aecf3b7ffb9acd52eaec43fb6295aedefd57cc4489010813
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and ML classifiers, exhibiting characteristics of a phishing lure. It contains an image-based interface with a clickable link disguised as a game download, directing users to a suspicious URL. The presence of numerous external links suggests a link farm designed to distribute malicious content or facilitate phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7842

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 47 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=descargar+metal+gear+solid+2+sons+of+liberty+para+pc+en+espa%25C3%25B1ol
    • https://cdn.sqhk.co/sewadokoka/Pjejc4g/neutron_music_player_eval.pdf
    • https://cdn.sqhk.co/susotizakaxe/ejcjMha/mobile_soccer_league_mod_apk_unlimited_money.pdf
    • https://static.s123-cdn-static.com/uploads/4366351/normal_5fcbdd69df8fb.pdf
    • https://cdn.sqhk.co/veleviziwew/haidgha/8240647431.pdf
    • https://static.s123-cdn-static.com/uploads/4379237/normal_5fcf7bfa7182f.pdf
    • https://pusexijubod.weebly.com/uploads/1/3/5/2/135296384/zaxopegekuwedufiwa.pdf
    • https://cdn.sqhk.co/jarixizotib/dRph9Wb/povolusepajumod.pdf
    • https://cdn-cms.f-static.net/uploads/4384851/normal_605b726015b85.pdf
    • https://cdn.sqhk.co/danopefasuf/jgcwieb/using_game_genie_on_nes_classic.pdf
    • https://cdn.sqhk.co/letarezetap/hbibhgc/87528995614.pdf
    • https://padawevuwelidas.weebly.com/uploads/1/3/1/4/131438111/f814e004323565f.pdf
    • https://cdn.sqhk.co/kixobaza/vLzCHgi/tulusela.pdf
    • https://static.s123-cdn-static.com/uploads/4421768/normal_5fe3ea580daf9.pdf
    • https://mebotorafegamor.weebly.com/uploads/1/3/0/7/130739377/6922359.pdf
    • https://cdn-cms.f-static.net/uploads/4481289/normal_60496ab62b5b7.pdf
    • https://votuwokikinoso.weebly.com/uploads/1/3/4/4/134466575/gipuw.pdf
    • https://cdn.sqhk.co/jilowepe/dFAhhja/fire_poweramp_visualization_apk.pdf
    • https://cdn.sqhk.co/godezixibufo/djgSSh2/91261206752.pdf
    • https://cdn.sqhk.co/raratajuxu/iiyJygi/legeputizi.pdf
    • https://21a67f6d-2aea-439f-a910-ed4feb6be009.filesusr.com/ugd/173616_89ac28d357bf4309a95c80244666a8e8.pdf?index=true
    • https://ad1ab7a2-fed4-4f9a-b892-868933c94317.filesusr.com/ugd/b914b5_2a1c42064c5745b2a04890ef693362db.pdf?index=true
    • https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_89cf3ba70e0340bbb33937d376750965.pdf?index=true

Open this report in the interactive analyzer, or submit your own file for analysis.