PDF malware analysis — malicious · 4908dc5a4e365960

MALICIOUS

PDF

56.2 KB Created: 2021-04-06 04:50:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02

MD5: 7651a726d97e37e23235dadedb902677 SHA-1: 5ded2b6c05f3eb7cbc21b66fdd75326601343ddc SHA-256: 4908dc5a4e365960ada1581cfe58fa4ba90ed8d84c9e6216b04ef96509d639c0

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, many pointing to disposable domains, suggesting a link farm or phishing lure. The document body, though heavily obfuscated, contains references to 'World war z game multiplayer split screen' and 'wkhtmltopdf', potentially used as bait to attract users to click on the malicious links.

Machine Learning

Nyx PDF Classifier malicious score 0.7084

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://maypoin.ru/strik?utm_term=world+war+z+game+multiplayer+split+screen PDF link annotation
- http://matawobedopikam.mywebcommunity.org/26508645771.pdfIn PDF document text
- http://kalukawuwo.mygamesonline.org/feature_article_structure.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470038/normal_60174abb66d11.pdfIn PDF document text
- http://degimogug.mypressonline.com/baby_bjorn_carrier_newborn_youtube.pdfIn PDF document text
- http://gazupoz.sportsontheweb.net/57541914169.pdfIn PDF document text
- http://tixesikixux.mygamesonline.org/85366005251.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4479222/normal_6023dd6226e0a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379626/normal_5fe79c8fcb283.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dad289ee-8750-457d-a793-35c67b42f328/what_kind_of_pasta_is_in_minestrone_soup.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/535044bb-239e-49a5-b260-87aea500f757/cloud_practitioner_salary_in_india.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/46a24aa5-7c89-48c1-97c0-592f30a9d0f6/bexisodazapuzo.pdfIn PDF document text
- https://s3.amazonaws.com/vonutavekip/54721060740.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e0b6ef28-9c1d-43d1-a9bf-ef6b4300fc6b/51992585470.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8ac46c2a-5547-4c86-aab7-f48dc3e5df1d/sentry_1250_safe_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc6f558b-376e-48d6-9b97-4afeebf8bdd3/69466113862.pdfIn PDF document text
- https://s3.amazonaws.com/lowuwofuxali/85616152943.pdfIn PDF document text
- https://s3.amazonaws.com/genijusemu/rotuxi.pdfIn PDF document text
- https://s3.amazonaws.com/rujabepifar/7769387972.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9977084b-6bd1-445f-ab5c-63f3be23850d/xanexamowenaligofu.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.