Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f12031bd89edd77…

MALICIOUS

PDF

55.7 KB Created: 2021-06-02 16:51:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 016891071216ac3c38a4b1bf8ecda75a SHA-1: 61e1e3b790a2660bbad8d29416cd2ac0756b8ace SHA-256: 3f12031bd89edd77cbf69068930c63cb6acd5209289c2eabe3f29bcb3d57a409
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. It contains a large number of external links, many of which are to benign-looking documents, but one is directly to a suspicious domain. The ML classifier also assigned a high probability of maliciousness. The file likely serves as a lure to direct users to malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9557

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/pbw?utm_term=que+es+mezclas+heterogeneas+en+quimica
    • https://xerotopofuwega.weebly.com/uploads/1/3/1/4/131406930/3148220.pdf
    • https://gixoxiri.weebly.com/uploads/1/3/4/7/134707295/tugopixu.pdf
    • https://vusesuke.weebly.com/uploads/1/3/4/7/134723580/2b2bd1b8fe23.pdf
    • https://mawebugejememed.weebly.com/uploads/1/3/4/5/134599942/losasuw.pdf
    • https://renibopasuviwi.weebly.com/uploads/1/3/4/3/134305424/zizizurojalupubus.pdf
    • https://vakilonote.weebly.com/uploads/1/3/1/3/131382032/5b6ff.pdf
    • https://uploads.strikinglycdn.com/files/87272f1a-ff91-46b1-b385-a98a18a60789/how_to_scan_using_printer_hp_deskjet_2135.pdf
    • http://mituxap.pbworks.com/w/file/fetch/144425349/3ds_max_vray_material_tutorial_free_download.pdf
    • https://uploads.strikinglycdn.com/files/67110897-1c59-42f3-831a-a2b0d075060a/pewdiepie_minecraft_world_download_mcpe.pdf
    • https://uploads.strikinglycdn.com/files/9b592fb6-fbe8-42c7-89dd-4f4972821fcd/95628233427.pdf
    • https://uploads.strikinglycdn.com/files/cf02c93f-13a6-48ec-a2b5-7947893743b1/gefuvepa.pdf
    • https://uploads.strikinglycdn.com/files/c69f9802-ee77-46f0-a537-af7f2cb47c79/layer_3_and_layer_4_attacks.pdf
    • https://uploads.strikinglycdn.com/files/8ff3e354-b8e2-40ce-b8c8-3cbad8bb0cbe/after_we_collided_book_plot_summary.pdf
    • https://uploads.strikinglycdn.com/files/c9173155-2475-4228-a3ed-876341e7a1f1/comprehensive_radiographic_pathology.pdf
    • https://uploads.strikinglycdn.com/files/86dbdb48-e404-4d1b-9f23-3094e7cd6c53/13681152229.pdf
    • https://uploads.strikinglycdn.com/files/ec3450a7-a086-4a78-af72-19401d2ace09/who_appoints_audit_committee.pdf
    • https://uploads.strikinglycdn.com/files/94d1febc-254e-4e07-bf9d-ee2c8bf3fd94/digital_signal_processing_principles_algorithms_and_applications_4th_edition.pdf
    • http://viluxese.pbworks.com/f/deweratumogotup.pdf
    • https://uploads.strikinglycdn.com/files/0cf60d55-e0b7-4b0c-b6c9-f9afc4cb2c8d/excel_macros_for_dummies.pdf
    • http://wuvebag.pbworks.com/w/file/fetch/144424671/is_k-12_effective_or_not.pdf
    • http://zikupuzajix.pbworks.com/f/ffa_alumni_logo_black_and_white.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.