Malicious PDF — malware analysis report

Static analysis result for SHA-256 416b255f2582418d…

MALICIOUS

PDF

49.2 KB Created: 2021-05-24 09:26:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2e55dc820d2f84c79c94f0c973133526 SHA-1: f78eebde4dd45306366313181046fc94ae1d245f SHA-256: 416b255f2582418de3afc8dcfddc01a36ae35e0b22786e64372447b9d5f581a1
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-only nature and a clickable action that directs to an external URL. The primary URL, 'https://jottigo.ru/strik?utm_term=navicat+for+mysql+free+download+for+mac', is suspicious and likely leads to a malicious payload or phishing page. The document also contains a link farm of other PDFs, suggesting SEO-based distribution tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7209

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 49 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=navicat+for+mysql+free+download+for+mac
    • https://cdn-cms.f-static.net/uploads/4483336/normal_600ea92944d0a.pdf
    • https://zogadinarele.weebly.com/uploads/1/3/1/4/131409244/saget-vizobeged-kosorunekotej.pdf
    • https://cdn-cms.f-static.net/uploads/4426677/normal_60362d098da3b.pdf
    • https://pofekivivefuron.weebly.com/uploads/1/3/5/3/135339802/zigudafefagejeme.pdf
    • https://cdn-cms.f-static.net/uploads/4481540/normal_6060584200970.pdf
    • https://static.s123-cdn-static.com/uploads/4459916/normal_5fe2c7f698070.pdf
    • https://static.s123-cdn-static.com/uploads/4530868/normal_5fedcaeb93442.pdf
    • https://mukoxawav.weebly.com/uploads/1/3/4/6/134627731/c1a32e.pdf
    • https://static.s123-cdn-static.com/uploads/4490547/normal_5ff3c45bb980c.pdf
    • https://bunonosuvon.weebly.com/uploads/1/3/5/9/135976801/vejesotazem.pdf
    • https://moxeguzivega.weebly.com/uploads/1/3/5/9/135965209/kegezorovelito.pdf
    • https://s3.amazonaws.com/lixisariwulo/54139291749.pdf
    • https://uploads.strikinglycdn.com/files/27a70e2c-0321-4ac1-a90f-122c4060dbf5/evinrude_etec_90hp_service_kit.pdf
    • https://s3.amazonaws.com/jivala/best_ad_blocker_android_2018.pdf
    • https://s3.amazonaws.com/xufoxorog/bukoxuxipibutozoxuba.pdf
    • https://uploads.strikinglycdn.com/files/d510db6a-f952-42cf-bca5-a25fea9cc19c/pantone_formula_guide_coated_2020.pdf
    • https://s3.amazonaws.com/wixamupelinere/92713069765.pdf
    • https://s3.amazonaws.com/zomuzigo/dapowuwavowutakevagofarar.pdf
    • https://s3.amazonaws.com/xufaxoferugod/percy_and_annabeth_sleep_together_fanfiction_rated_m.pdf
    • https://s3.amazonaws.com/tanapilamaxi/physics_principles_and_problems_chapter_9_answers.pdf
    • https://s3.amazonaws.com/gupawupigawono/67325769987.pdf
    • https://s3.amazonaws.com/sazariwapa/jevetosuwofakexa.pdf
    • https://uploads.strikinglycdn.com/files/ea71a355-16ef-4f17-8d57-753c12154f75/zesixenub.pdf
    • https://s3.amazonaws.com/netinuwa/mozovanimosazituwu.pdf