Malicious PDF — malware analysis report

Static analysis result for SHA-256 343b7847d44901ae…

MALICIOUS

PDF

66.6 KB Created: 2021-03-18 21:32:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f34fdea11e8feb005ce63e3f0fbb64f SHA-1: f6cb1de92d38cf05f2ef4328a77ed62932610352 SHA-256: 343b7847d44901ae8b61da5f7f8ec1dd201b58abb35ffd2390f1539f5a0d0ccc
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. It contains a large number of external links, many of which point to other PDF files, suggesting a link farm or distribution mechanism. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest the document's purpose is to direct users to a network of potentially malicious or SEO-manipulated content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9590

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=definition+of+the+american+dream+pdf
    • http://creditinquiry.info/bhojpuri_video_gana_mp4h8m0r.pdf
    • https://didegesub.weebly.com/uploads/1/3/2/6/132681352/cbab8.pdf
    • http://appeal-ig.com/75944739932n6ydu.pdf
    • http://blacklaser.ru/safikezinufinafyc9.pdf
    • https://mizunemaki.weebly.com/uploads/1/3/4/8/134850414/risajugoku.pdf
    • http://instapriz.website/can_you_change_the_language_on_japanese_n64_gamest0sy7.pdf
    • http://devlp.design/cae_exam_sample_testecy20.pdf
    • http://a-trvl.ru/230618549115jpso.pdf
    • http://remont-kvartir-otzyvy.moscow/battlefield_1943_xbox_360_iso57ybi.pdf
    • http://instup.xyz/waxadosafakitilumeduwekiryt457.pdf
    • https://muxiduxipa.weebly.com/uploads/1/3/5/3/135319221/312252.pdf
    • https://titenukom.weebly.com/uploads/1/3/4/5/134523185/lasuwopegosat.pdf
    • https://s3.amazonaws.com/papuja/rosasago.pdf
    • https://s3.amazonaws.com/sefabe/zazasodobuxeno.pdf
    • https://s3.amazonaws.com/gozifep/48467586485.pdf
    • https://s3.amazonaws.com/savukojubusum/home_studio_setup_guide.pdf
    • https://s3.amazonaws.com/fapaga/60302046651.pdf
    • https://s3.amazonaws.com/puretulenuza/passport_photo_template_mac.pdf
    • https://s3.amazonaws.com/boduxatavepe/adjective_noun_verb_forms.pdf
    • https://s3.amazonaws.com/simujix/free_whatsapp_status_punjabi_song.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.