PDF malware analysis — malicious · 3b176e8d4d4ad0a9

MALICIOUS

PDF

81.4 KB Created: 2021-10-08 20:10:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25

MD5: 5be2aa7e56b0ac6988515543a022bde2 SHA-1: 5ba08439f3a84541b97065efbd0eb5b33f25c35e SHA-256: 3b176e8d4d4ad0a9f584f0d12d535a8a501af56def34c2e57b597b5349d7cbbe

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains numerous embedded URLs, many of which point to disposable hosting and are part of a link farm, as indicated by the PDF_SEO_DISPOSABLE_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS and CLAMAV_DETECTION heuristics confirm the malicious nature of the file. The primary URL identified, https://medvor.ru/uplcv?utm_term=the+missing+number+is, is likely used to redirect the user to a malicious site for phishing or further payload delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.6557

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://medvor.ru/uplcv?utm_term=the+missing+number+is PDF link annotation
- http://acevina.com/webroot/img/files/92178698435.pdfIn PDF document text
- http://fongyoskert.hu/userfiles/files/puvugusaguge.pdfIn PDF document text
- http://ibrahimabuomira.com/ckeditor/ckfinder/userfiles/files/17248108627.pdfIn PDF document text
- http://automozg.by/upload/editor/files/20856373704.pdfIn PDF document text
- https://abouelhoulgroup.com/userfiles/files/7867143972.pdfIn PDF document text
- https://accesoriosalmayor.com/images/userfiles/file/77016332826.pdfIn PDF document text
- http://amdind.com/userfiles/file/59485798458.pdfIn PDF document text
- http://vagtteam.dk/userfiles/Files/tisubidifigi.pdfIn PDF document text
- https://queensflower.nl/clientfiles/bidipurijexujok.pdfIn PDF document text
- http://sushikyototogo.com/uploads/files/jifotutidebes.pdfIn PDF document text
- http://apicn.net/upload/files/87496515167.pdfIn PDF document text
- https://akgoz.zemta.com/uploads/files/94880813842.pdfIn PDF document text
- http://www.valathors.com/ckfinder/userfiles/files/mokufijobukuw.pdfIn PDF document text
- https://baoholaodong24.com/userfiles/file/20367500155.pdfIn PDF document text
- https://cargoservice.pl/cargoservice/userfiles/file/94596954958.pdfIn PDF document text
- https://yoimart.com/upload/file/20211004073245.pdfIn PDF document text
- http://uralteplostroy.ru/content/file/56061133075.pdfIn PDF document text
- https://marljivo.hr/UserFiles/files/gisuwo.pdfIn PDF document text
- http://johnmichaelharrisonlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/wegodufobufik.pdfIn PDF document text
- http://retailcop.ca/files/bowapaguposasugov.pdfIn PDF document text
- https://mkserwis.pl/userfiles/file/vevugijexedenakajasi.pdfIn PDF document text
- http://strojsteel.cz/webpagebuilder/ckfinder/userfiles/files/77321352366.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.