Malicious PDF — malware analysis report

Static analysis result for SHA-256 505e41e54396eba4…

MALICIOUS

PDF

95.5 KB Created: 2021-03-29 08:16:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b7ff8ebd25ab61dd537fce4c1fc9946e SHA-1: e27b9b9ca30fcfff59b78870ad13c13600a8f296 SHA-256: 505e41e54396eba488001b7d9ea51c820c3400e880ec3004734ecd9003aad7b4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which are SEO-optimized, suggesting a link farm or spamming operation. The ClamAV detection and ML classifier also indicate maliciousness. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards an attempt to redirect users to potentially malicious or unwanted content, likely as part of a phishing or SEO spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9619

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=unseen+academicals+terry+pratchett+pdf
    • http://vatetuda.scienceontheweb.net/22284782065.pdf
    • https://fowuwulavo.weebly.com/uploads/1/3/4/7/134754099/zixalok_mobumujeparaz.pdf
    • https://paxobafu.weebly.com/uploads/1/3/4/6/134697986/vivas.pdf
    • http://josebixotarez.22web.org/43508552584.pdf
    • http://pakizimavom.scienceontheweb.net/adjectives_list_english_spanish.pdf
    • https://kafaziwe.weebly.com/uploads/1/3/1/0/131070109/wamevowurenirur_tepurobibivum_biwubotaj_ledekig.pdf
    • https://s3.amazonaws.com/tuletivotarupu/nupoxima.pdf
    • http://zutulig.epizy.com/antariksham_9000_kmph_telugu_movie.pdf
    • http://mukagodikuve.rf.gd/mevizarolojo.pdf
    • https://uploads.strikinglycdn.com/files/040f85aa-db05-4d4e-a70f-3a2c656c1cc6/how_to_tell_if_furnace_filter_is_dirty.pdf
    • https://uploads.strikinglycdn.com/files/3927e571-8a92-4daf-b52d-701610bacb15/powermate_5000_generator.pdf
    • https://uploads.strikinglycdn.com/files/df84f9e5-6998-4c75-8fe9-317a5ec2924d/flammable_storage_cabinet_guidelines.pdf
    • https://s3.amazonaws.com/musokejixami/caterpillar_generator_sets.pdf
    • http://zedofaxuboz.onlinewebshop.net/fallout_4_quest_mods_for_xbox_one.pdf
    • https://uploads.strikinglycdn.com/files/65317acd-ce10-4966-904d-fd4868130446/1121398306.pdf
    • http://kaloruligot.onlinewebshop.net/bourbaki_set_theory.pdf
    • http://fefipunoz.rf.gd/1505947956.pdf
    • https://uploads.strikinglycdn.com/files/6afe90a8-a412-42b5-8a14-4bda370f0c2c/how_did_luke_find_out_leia_was_his_sister.pdf
    • https://uploads.strikinglycdn.com/files/4326bd96-f1b4-4c05-92f6-e33f7d696cd5/murotoramakerawupi.pdf
    • https://uploads.strikinglycdn.com/files/107b538f-d025-45e5-95ab-6c8f555f6bbe/303_squadron_battle_of_britain_cheats.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.