Malicious PDF — malware analysis report

Static analysis result for SHA-256 4790bc4c0761c1bf…

MALICIOUS

PDF

51.5 KB Created: 2021-06-15 12:12:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: fee3f934a9f0df83f7e00950378119ac SHA-1: c18c678ae24862a6d2a98af8ed32e944ee5de112 SHA-256: 4790bc4c0761c1bfac7a454f6164420c49db2eed4df4b2d1444afebec3c00697
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7206

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://archism.ru/pbw?utm_term=elder+scrolls+orc+name PDF link annotation
    • https://meverofukibax.weebly.com/uploads/1/3/4/6/134620555/137718.pdfIn PDF document text
    • https://norokeveja.weebly.com/uploads/1/3/4/7/134706326/wodunamosobodijeta.pdfIn PDF document text
    • https://jopulovi.weebly.com/uploads/1/3/4/2/134265775/fea73d3be.pdfIn PDF document text
    • https://pelosewedi.weebly.com/uploads/1/3/4/7/134753512/rumuxupup_bofugipat_vomurusinapi.pdfIn PDF document text
    • https://pewuwokajop.weebly.com/uploads/1/3/0/7/130775265/dinaxanuran_liraxonakef.pdfIn PDF document text
    • https://sajadarazaga.weebly.com/uploads/1/3/4/3/134340855/zotugezepez-fewobigafagufu-vubebig-tasadelopudo.pdfIn PDF document text
    • https://mubelumovetofap.weebly.com/uploads/1/3/1/8/131856402/dirirufat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03ef64b2-ec36-40fc-8eb8-0fe3611a40d6/gikanaxubatifowivevuga.pdfIn PDF document text
    • http://lipovosufuk.pbworks.com/w/file/fetch/144781317/dark_matter_book_sequel.pdfIn PDF document text
    • http://debigolona.pbworks.com/f/61398929097.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b02637ba-f67f-4554-8ca1-63accbb8a8e4/how_to_fix_a_squeaky_dryer_belt.pdfIn PDF document text
    • http://padimagofo.pbworks.com/w/file/fetch/144458454/65249004755.pdfIn PDF document text
    • http://kekivozafiko.pbworks.com/w/file/fetch/145211397/download_film_blue_is_the_warmest_color_ganool.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06c34811-f558-4950-9153-79a12cf2ffb7/duzut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7bfd9299-04cb-4973-b6df-abe6376e3f8a/pemofudaligigoxipope.pdfIn PDF document text
    • http://kegujomojos.pbworks.com/w/file/fetch/145233258/57028405989.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64603a07-ba6e-4dab-aa16-d80957eccd57/namaz_e_nabvi_darussalam_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e721e490-97a1-45b4-8a48-91b9ec3b8df3/xivapinojigu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42918621-0e96-42a5-bd5f-07dea73cd5b3/dish_network_channel_guide_local_channels.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95a03e25-885d-424e-b642-a78a498ca290/java_programming_full_course_free.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.