Malicious PDF — malware analysis report

Static analysis result for SHA-256 329bf357a2c42684…

MALICIOUS

PDF

52.4 KB Created: 2021-05-23 11:15:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 092e1bebde0cf809b13d5a75f297a85d SHA-1: 0ffb384800f966c1550585f30f7d0a8ed28b5eb8 SHA-256: 329bf357a2c42684f1d5f68381e2f4f772886be92e0d0f154c5ee5972130a200
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous external links, many pointing to seemingly benign documents, but one primary URL is suspicious and associated with a phishing heuristic. The document body is heavily obfuscated and appears to be a lure, possibly related to herbicide mixing, to direct users to the malicious domain. The presence of PDF-specific heuristics and embedded URLs indicates an attempt to exploit PDF viewers or trick users into navigating to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7151

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=how+to+mix+curtail+m+herbicide+for+lawns PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4482623/normal_5fcfa93292287.pdfIn PDF document text
    • https://mavipevawifuduv.weebly.com/uploads/1/3/4/5/134598931/d1e8edb4.pdfIn PDF document text
    • https://vowevabejera.weebly.com/uploads/1/3/0/7/130775986/dikubux.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408864/normal_605ee61df02a7.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14cbc11f-9ffa-4d53-82d8-e5a56f408655/oll_algorithms_cubehead.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f8b8657d-7ec3-4045-b585-6a93c9ad2ec8/when_something_is_important_to_you_quotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c5970a1-6de8-409a-906d-36241e358233/1970_ford_mustang_mach_1_428cj_for_sale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7c07e1e-d7ca-4748-80cf-37478a639641/kenmore_he2_plus_error_code_f33.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/995baabc-5fe1-464d-8de4-cf603c20fefb/the_wrath_and_the_dawn_webtoon_reddit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fad03eb-4b93-48b3-af93-c68183d21040/rewugedatuxasunev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32997d46-c920-410e-a403-2e4a7fa29219/gapefovezuwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6530680b-cf3d-4733-8c55-f8ab4c0ae92b/thank_you_maverick_city_lyrics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6e37533-6f92-43c3-8c5c-11d9298c1496/49698355894.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20444b46-5c34-4b78-bf23-f40fda285979/emotional_intelligence_book_by_daniel_goleman_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e5f8eac-b933-4b2f-a14f-3cf13e3cf620/2019_kawasaki_kx100_price.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.