Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b0e33c88712d0ed…

MALICIOUS

PDF

57.1 KB Created: 2021-06-01 21:15:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 46ae80bd062eec3b6cb6146707d37757 SHA-1: 641d3498c855088209594d00e9c5d5560f6ac7af SHA-256: 3b0e33c88712d0ed84a822fcfe89b7221d774b615fb7e68af52a19543744e7f9
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, with one heuristic specifically identifying a 'mass external PDF link farm'. The document body, though heavily obfuscated, contains text related to movie subtitles, suggesting a lure. The presence of a ClamAV detection for 'Pdf.Phishing.Trojan' and a high ML score further indicate malicious intent, likely for phishing or malware delivery via the linked URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6420

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/pbw?utm_term=fast+and+furious+tokyo+drift+sub+indo+480p
    • https://cdn-cms.f-static.net/uploads/4422637/normal_60591f5466d47.pdf
    • https://xetomulezaze.weebly.com/uploads/1/3/0/9/130969551/4859778.pdf
    • https://cdn-cms.f-static.net/uploads/4380869/normal_6052b558ca0a0.pdf
    • https://makezuxakoje.weebly.com/uploads/1/3/0/7/130739015/muduvamugoxuzu.pdf
    • https://dumuwikodopod.weebly.com/uploads/1/3/4/4/134458554/be5ab611d7d7c16.pdf
    • https://static.s123-cdn-static.com/uploads/4367937/normal_60045988dfc79.pdf
    • http://pojaweku.pbworks.com/f/wunadodipipapaxu.pdf
    • https://uploads.strikinglycdn.com/files/69046fe4-8fa6-4999-9f82-2d64118bfd9e/how_to_use_the_kitchenaid_food_processor_attachment.pdf
    • http://fotikeralo.pbworks.com/w/file/fetch/144475617/active_and_passive_voice_online_exercises_for_class_8.pdf
    • https://uploads.strikinglycdn.com/files/d844dabd-6ed3-4831-8b16-08af16542c14/nipovasadizotam.pdf
    • https://uploads.strikinglycdn.com/files/b0ebf60c-6f80-4280-8d27-26596d3789e9/coda_shop_pro_ff_gratis.pdf
    • https://uploads.strikinglycdn.com/files/41b2b17a-1d7b-4812-80e4-17b3a3b20b66/61303603531.pdf
    • https://uploads.strikinglycdn.com/files/802d3333-49a6-41c9-a962-0f9292eabd3a/fl_studio_11_producer_edition_full_download_windows_10.pdf
    • https://uploads.strikinglycdn.com/files/675d81e2-98fe-4c36-8139-3ee597010554/like_water_for_chocolate_trailer.pdf
    • http://banusiv.pbworks.com/f/epl_live_streaming_iphone_app.pdf
    • https://uploads.strikinglycdn.com/files/b89fa2f1-96a9-4901-96da-851ed5e3e532/tiluvaxifipibuminenev.pdf
    • http://mumubib.pbworks.com/w/file/fetch/144413745/dovosufema.pdf
    • https://uploads.strikinglycdn.com/files/b8777fd4-834d-4513-8d88-c5d306dac21b/shark_navigator_swivel_pro_vs_lift_away.pdf
    • http://fodorafirig.pbworks.com/w/file/fetch/144446745/types_of_chemical_reaction_worksheet_answer_key.pdf
    • http://xetibubib.pbworks.com/f/shopping_stores_in_schaumburg_illinois.pdf
    • https://uploads.strikinglycdn.com/files/eaa90856-5d94-4dae-888b-68f4c97969b4/97118845535.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.