PDF malware analysis — malicious · 32dd4f4f4e1c680d

MALICIOUS

PDF

51.0 KB Created: 2021-04-30 04:09:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24

MD5: 412977f48b6d5d91ae7f27834dc51226 SHA-1: 7050e6a3d8d78edaf4ba9754e5a06bb9f8595c05 SHA-256: 32dd4f4f4e1c680d517ca83ab6cfac901d0f914cc40bf43d64c1a0ccfdf1a976

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs, many pointing to disposable domains and employing UTM parameters, indicative of a link farm or phishing lure. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded links are consistent with a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.7510

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/strik?utm_term=how+do+i+pair+my+blueparrott PDF link annotation
- https://divamokavagi.weebly.com/uploads/1/3/4/8/134871471/bimujadalosez.pdfIn PDF document text
- http://50offstore.pro/sample_spreadsheet_for_budgetud99c.pdfIn PDF document text
- http://mihetos.xyz/ab_doer_twist_scale_manualcenie.pdfIn PDF document text
- http://crispyset.online/why_wont_my_ue_boom_pairqddzc.pdfIn PDF document text
- http://muzojumovove.iblogger.org/toxoplasmosis_life_cycle.pdfIn PDF document text
- http://bigops.fun/jawebigxrir.pdfIn PDF document text
- https://cdn.sqhk.co/wigatozaduw/eRgeie0/narijidomegomi.pdfIn PDF document text
- http://nicepics.xyz/cuanto_es_1_2_pulgada_en_milimetrosyn63z.pdfIn PDF document text
- https://tobejisexin.weebly.com/uploads/1/3/1/4/131454505/1331552.pdfIn PDF document text
- https://cdn.sqhk.co/jefapukawore/lOGBmic/best_hex_wargames.pdfIn PDF document text
- https://nafuxiba.weebly.com/uploads/1/3/4/0/134097784/7965893.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45d4d83f-0ec1-4c17-ba99-9bda8925b0f8/mobesesebe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73e6d463-3ef2-4248-8906-6b05c63ecb08/how_to_dye_hair_evenly.pdfIn PDF document text
- https://s3.amazonaws.com/wajibile/29242001786.pdfIn PDF document text
- http://nenilezum.epizy.com/70006573488.pdfIn PDF document text
- http://kejiguwudo.epizy.com/how_to_install_my_roku_stick.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c6f49ccd-9e78-42c1-9d38-77c819e90ee7/mulofipib.pdfIn PDF document text
- https://s3.amazonaws.com/pugomonapoxuxe/changer_sac_aspirateur_electrolux_silent_performer.pdfIn PDF document text
- https://s3.amazonaws.com/fizup/50549023440.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6ca84a9e-e75b-4a4c-b303-2a7d1c445c97/how_much_does_chick_fil_a_franchise_make.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.