Malicious PDF — malware analysis report

Static analysis result for SHA-256 4397083c2a0dd570…

MALICIOUS

PDF

47.6 KB Created: 2021-02-25 02:39:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 2af04033f50191a9ab1b827e97bb0fd6 SHA-1: d2957d0b61e9ba3606ca7e6d69fddba123a3b2b0 SHA-256: 4397083c2a0dd570a4bdaec1854e1c53410e9f8f42a6a390279057dcc7e7e347
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7585

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=how+to+change+my+dometic+thermostat+to+fahrenheit PDF link annotation
    • http://livethailand.fun/kicking_horse_river_rafting_banff3umuz.pdfIn PDF document text
    • http://fifamarketbot.com/dd_3.5_prestige_classes_tier_list79rgb.pdfIn PDF document text
    • https://cdn.sqhk.co/jigugabopu/YLiyjct/82495639683.pdfIn PDF document text
    • https://cdn.sqhk.co/zojixemem/5hagia7/chocolate_cake_recipe_buttercream_icing.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409623/normal_6017ab089350f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484632/normal_60001015eefc2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374689/normal_6028f76980d9c.pdfIn PDF document text
    • https://cdn.sqhk.co/vefemenivu/hdehhgf/20280282673.pdfIn PDF document text
    • http://anarchymedya.com/carefree_electric_awning_installation_manualvke7i.pdfIn PDF document text
    • https://cdn.sqhk.co/keropolor/isNgfmA/91953178905.pdfIn PDF document text
    • https://cdn.sqhk.co/pujixefan/jJRTaia/auto_change_wallpaper_mod_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/lepavenujal/0FieGTo/galaxy_attack_alien_shooter_para_pc_gratis.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474191/normal_5ff3c0c30e7be.pdfIn PDF document text
    • http://pofaduxiruk.getenjoyment.net/73649661115.pdfIn PDF document text
    • http://viniveba.mywebcommunity.org/63590368685.pdfIn PDF document text
    • https://cdn.sqhk.co/xixewebirike/hgsnico/kazix.pdfIn PDF document text
    • https://cdn.sqhk.co/gijimexuv/jhjgbgg/xejapogoberazubumap.pdfIn PDF document text
    • http://gratoraama.space/95329523703fj7lu.pdfIn PDF document text
    • http://tobobuximalusu.epizy.com/sandy_hook_surf_fishing_report.pdfIn PDF document text
    • http://zupitatip.atwebpages.com/forgotten_realms_series_order.pdfIn PDF document text
    • http://jumepenitujox.atwebpages.com/coast_guard_gar_model_orm.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.