Malicious PDF — malware analysis report

Static analysis result for SHA-256 34df5217dadaaf41…

MALICIOUS

PDF

88.7 KB Created: 2021-05-19 09:10:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: a75daddcfb6c1574fdaae4c0898e4b10 SHA-1: 14c911f5e875351da00d8e12a1acb4f2a8a704c1 SHA-256: 34df5217dadaaf4146662d1b8e72d759ff2f7461c4101b84a96c0d5ea16fb509
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous external links, including a link farm heuristic, suggesting an attempt to direct users to malicious websites. The document body, though heavily obfuscated, contains text related to downloading ROMs, which is used as a lure. The ClamAV detection and ML classifier indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7276

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=where+to+download+nintendo+ds+roms+reddit PDF link annotation
    • https://sikufotoxatufik.weebly.com/uploads/1/3/4/4/134458503/wufagijoxu.pdfIn PDF document text
    • https://rokajovata.weebly.com/uploads/1/3/4/3/134376264/6792957.pdfIn PDF document text
    • https://mowolonob.weebly.com/uploads/1/3/4/8/134874237/zonixojuv.pdfIn PDF document text
    • https://jaweditulopo.weebly.com/uploads/1/3/4/3/134313576/1921464.pdfIn PDF document text
    • http://jupizuginilumop.22web.org/gujividuvuzoriberepefe.pdfIn PDF document text
    • https://mevinabepoke.weebly.com/uploads/1/3/2/7/132740553/rebirazubexupasole.pdfIn PDF document text
    • https://rokosogamutoluf.weebly.com/uploads/1/3/0/8/130873735/2905881.pdfIn PDF document text
    • https://dekilaroturiti.weebly.com/uploads/1/3/1/8/131856809/lusozerabopoxix.pdfIn PDF document text
    • https://zafivagofe.weebly.com/uploads/1/3/6/0/136011523/5678703.pdfIn PDF document text
    • https://s3.amazonaws.com/debiwelof/culture_betsileo.pdfIn PDF document text
    • https://s3.amazonaws.com/piradi/snow_white_with_the_red_hair_zen_and_shirayuki_moments.pdfIn PDF document text
    • https://s3.amazonaws.com/tigovatolis/how_to_put_logitech_k400_keyboard_in_pairing_mode.pdfIn PDF document text
    • https://s3.amazonaws.com/mogedozara/jogeperanerimezekeke.pdfIn PDF document text
    • http://sedilar.rf.gd/python_list_functions_cheat_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/wujafivabipo/tasovew.pdfIn PDF document text
    • https://s3.amazonaws.com/fidefofudi/66453034680.pdfIn PDF document text
    • http://wedalavunobuwe.rf.gd/bcp_business_continuity_plan.pdfIn PDF document text
    • http://didaledagaxuz.rf.gd/14446136862.pdfIn PDF document text
    • https://s3.amazonaws.com/woneketelak/ritezavosiruf.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.