PDF malware analysis — malicious · 473320c4503bf138

MALICIOUS

PDF

48.8 KB Created: 2021-03-31 01:07:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07

MD5: 0fb5e418026c10e8dab63b9f8572a5c6 SHA-1: d0b4d6d4fc84acffa6e1f5b46566edc1d737f65f SHA-256: 473320c4503bf13885b1aca42973cf33872488b485d854e23464ddf7a70dcff0

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file contains a large number of external links, many of which are disguised as relevant content, indicating a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier also flagged this file as malicious, specifically as a phishing trojan. The embedded URLs suggest an attempt to redirect users to potentially malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.7155

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fokemale.ru/award?keyword=malayalam+bible+study+acts+pdf PDF link annotation
- http://reduslimitaly-ufficiale.site/rule_for_multiplying_square_roots4au9m.pdfIn PDF document text
- http://kuroramogesok.iblogger.org/ultratech_im-_1270_datasheet.pdfIn PDF document text
- https://biwoponafi.weebly.com/uploads/1/3/4/7/134767969/tutubifofokeka.pdfIn PDF document text
- https://zosotise.weebly.com/uploads/1/3/5/3/135393527/8408575.pdfIn PDF document text
- http://in-step.shop/design_and_analysis_of_algorithms_notes_for_mcasiql7.pdfIn PDF document text
- http://maturibcgj.space/deadpool_comics_20201osu9.pdfIn PDF document text
- http://save50it.info/soniwipitemepowabubajyyry.pdfIn PDF document text
- http://lnstagramcopyrigtservice.com/chamberlain_universal_keypad_not_working88wa9.pdfIn PDF document text
- https://s3.amazonaws.com/kovilowab/the_snack_shack_abersoch_menu.pdfIn PDF document text
- https://s3.amazonaws.com/kukupunopedon/awe_tuning_991_carrera_performance_exhaust.pdfIn PDF document text
- https://s3.amazonaws.com/waxegatulo/vcloud_director_vm.pdfIn PDF document text
- https://b3e719cc-30df-460f-a5cd-d2fa480fcfac.filesusr.com/ugd/b2b6a5_c75b0bbdce15426dac1bee4520b62cb7.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vebisop/rosa_rubiginosa_herbiguide.pdfIn PDF document text
- http://tupiremere.epizy.com/optiplex_755_specs_64_bit.pdfIn PDF document text
- https://ab0007c4-58ca-4db2-ab23-686bae4d53c1.filesusr.com/ugd/8bf248_0bc3ab75073a4487a0d497dd94018f70.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kugelilizibuwum/the_bell_bandit_book_report.pdfIn PDF document text
- https://s3.amazonaws.com/polojuliragam/whirlpool_washing_machine_manual_book.pdfIn PDF document text
- https://s3.amazonaws.com/gotijejaj/tewexasexeli.pdfIn PDF document text
- https://s3.amazonaws.com/zagapaxa/pewenedawubutago.pdfIn PDF document text
- https://9f61dd91-ea7e-4edc-a837-c43fae5dccfb.filesusr.com/ugd/ed897c_77ffa30cfb6347d8b86d0632c7a75cde.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/rexogeguxosix/84203554274.pdfIn PDF document text
- https://75a697d3-84f0-44cf-bab9-f05e37020c50.filesusr.com/ugd/7c3584_c229d1384ea646269370da2235ec4d57.pdf?index=trueIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.