Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c3009f6c56a0953…

MALICIOUS

PDF

61.3 KB Created: 2021-04-14 02:47:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: aec67e0286d686585e357d888850cc6e SHA-1: 8e9dd3d9e1fedc6a9c7873d8a7205c0ae9ac9e69 SHA-256: 3c3009f6c56a0953dabdb09033a0f3eeb4aa5e1b9b0f856748082d89086d2126
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as a malicious PDF by ClamAV and exhibits characteristics of a link farm, containing numerous external URLs. The PDF structure and heuristic firings indicate it's designed to redirect users to potentially harmful sites, with one URL pointing to a phishing-related domain. While no scripts were explicitly extracted, the PDF format itself can embed JavaScript for malicious purposes, hence the inclusion of T1059.007.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4988

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=osmolarity+of+potato+tuber+tissue PDF link annotation
    • https://ab25a8b3-4d80-4d4b-93a1-c1347014fa7c.filesusr.com/ugd/8d0191_145b297f8d7f4590b2a295e713bf6118.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a1d0d8e-f57b-434a-89de-e4557341f185/signature_assignment_templates.pdfIn PDF document text
    • http://jesegusanasukan.epizy.com/chal_mere_bhai_movie_full_hd.pdfIn PDF document text
    • https://c0b8f06b-4e98-4d3d-89ef-2f08caba629a.filesusr.com/ugd/0c8cc8_170654273a4648deaaaddc213965391d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/289274aa-1168-4840-b061-63bf232f9ada/33145695543.pdfIn PDF document text
    • https://7be326e9-a1fd-4761-a84c-83c904220737.filesusr.com/ugd/37e945_335784ba4a80461a99f02977cd995b28.pdf?index=trueIn PDF document text
    • http://nopexuwub.rf.gd/21104805477.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b561ab92-9f6d-4e0b-8111-7d335ce94618/stan_getz__joo_gilberto_the_girl_from_ipanema_ft._antnio_carlos_jobim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b407fb24-39b1-4f93-a234-df0da6ec388c/wings_of_fire_comic_book_series.pdfIn PDF document text
    • https://a540aa65-2eb1-4ac3-86d0-bf6a54daac96.filesusr.com/ugd/2d797c_cf7a3f730aee4f05923971b862bfe747.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/56f16cec-6c9c-4489-9030-38bf14dd6ca1/how_to_use_frozen_drink_machine.pdfIn PDF document text
    • https://c8a164a7-2549-4056-b209-d27d417f800b.filesusr.com/ugd/136d3d_b738cb29b9a3416296f374cb640c9cb9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2caa0818-017e-4d8d-aa2a-d0802817da1e/zejadowa.pdfIn PDF document text
    • https://34184745-b1ec-4725-b105-60c94cc90871.filesusr.com/ugd/63369f_9169f05b117647488d7cfd305b0b83e9.pdf?index=trueIn PDF document text
    • https://82656f1f-dd0f-4426-89ca-c5688288f975.filesusr.com/ugd/56de54_60049bc8ed6a44089f158bb82fc60e86.pdf?index=trueIn PDF document text
    • https://3f054cde-0430-4828-89d0-5f77035cf230.filesusr.com/ugd/d93890_0e3b4e01796d44a09eef569b36e8803d.pdf?index=trueIn PDF document text
    • https://5121d360-3808-4f61-aa44-d87cf2d9d428.filesusr.com/ugd/032e8a_6ae2dc3d9bd045d4994cd6a29e0a5635.pdf?index=trueIn PDF document text
    • https://804b95bc-9ca4-448d-a094-5a8e1ff69a26.filesusr.com/ugd/99d1da_c8559bf87e7d48f782ff76c7d757700d.pdf?index=trueIn PDF document text
    • https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_7d50e835076e4dfeb05db09f4f271f54.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b76c4310-7638-4688-b904-60cc6087ae95/why_is_my_refrigerator_making_a_knocking_noise.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c01d9501-8f49-4bea-8d8a-2b4e11b4858b/badiredut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3b110c7-545f-4b0a-be99-c3cf261e09b0/casio_fx-9860gii_factorial.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/567bc600-220c-41bb-adf4-72b46e45967c/general_chemistry_petrucci_10th_edition_solutions_manual_free.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.