Malicious PDF — malware analysis report

Static analysis result for SHA-256 440d5f53243507a5…

MALICIOUS

PDF

40.1 KB Created: 2021-03-11 00:09:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 448b6653ea642277aa3170d44be18bf0 SHA-1: 52992d522b79d1608eeb589693cb36e75f462317 SHA-256: 440d5f53243507a5859411f2e7211183a1eac58dd4ca96fafa260125f0a2a24c
204 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing lure. It contains a single image, suggesting a screenshot designed to trick users into clicking an embedded external URI. The document also functions as a link farm, hosting numerous external PDF links, many of which are on disposable domains, indicating a potential effort to distribute malicious content or engage in SEO manipulation for phishing purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7868

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 40 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=caryl+churchill+serious+money+pdf PDF link annotation
    • http://about-central.com/63933345299x7n29.pdfIn PDF document text
    • http://seomagnat1.online/faxumawizaxelalamilubav1y9zy.pdfIn PDF document text
    • http://delinapod.mypressonline.com/45229335984.pdfIn PDF document text
    • http://pufivuziviv.mypressonline.com/96948643784.pdfIn PDF document text
    • http://vedovipog.22web.org/what_did_mary_poppins_call_her_umbrella.pdfIn PDF document text
    • https://juwexulomo.weebly.com/uploads/1/3/4/3/134385858/gunifotupatamitu.pdfIn PDF document text
    • https://zukolipiniroti.weebly.com/uploads/1/3/4/4/134494738/kebedevorusemavigab.pdfIn PDF document text
    • http://vosajizegek.mypressonline.com/imperative_programming_textbook.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f56c441b-cfaf-45d4-aa90-b8fb8df335ae/naza_lite_to_v2_firmware.pdfIn PDF document text
    • https://s3.amazonaws.com/vavabi/costco_sheet_cake_ingredients_list.pdfIn PDF document text
    • http://rozabuveragavep.epizy.com/what_are_the_primary_differences_between_the_central_and_peripheral_nervous_systems.pdfIn PDF document text
    • http://jasudewibolix.rf.gd/blaupunkt_car_audio_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/84d1e4a3-00ad-4f02-8be2-395676281c19/falifafudabavime.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7539e74a-2fc2-4835-ac58-2473e8ab94e1/minidalosenativonid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e0d5cc9-0f67-4b70-96fb-1efabdbe2e3d/what_are_the_rounds_in_cognizant_interview.pdfIn PDF document text
    • https://s3.amazonaws.com/fixararololu/5th_grade_math_elapsed_time_worksheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91763af5-f386-4885-a77b-f1c8a186efac/84830802815.pdfIn PDF document text
    • https://s3.amazonaws.com/tixedujegibex/tippmann_a5_custom_parts.pdfIn PDF document text
    • http://zimopup.myartsonline.com/wordpress_themes_for_authors_book.pdfIn PDF document text
    • https://s3.amazonaws.com/gezizefefififa/35657077006.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.