PDF malware analysis — malicious · 527c2e3b533e0c72

MALICIOUS

PDF

84.6 KB Created: 2020-12-28 09:22:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7f75bc45033824cc8a933d3d195f2771 SHA-1: ebd9554ba7603874330313992c0189512673c8c5 SHA-256: 527c2e3b533e0c721f8de0edd244fdee139147323ff1b2dcea0564b5aa13d51d

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing attempt. The ML classifier and ClamAV also flagged the file as malicious. While no scripts were extracted, the presence of numerous external URLs indicates an attempt to redirect users to potentially harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9131

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/aws?utm_term=agrarian+reform+policies+in+the+philippines+tagalog
- https://cdn-cms.f-static.net/uploads/4366958/normal_5fa43469e0f8e.pdf
- https://cdn-cms.f-static.net/uploads/4481058/normal_5fe97f9dece6d.pdf
- https://cdn.sqhk.co/baxemazisod/AiajfSp/xupevukotususagisifipere.pdf
- https://cdn.sqhk.co/dodiniwotud/ggjhpgf/ninja_fighter_full_movie.pdf
- https://cdn.sqhk.co/ripigopes/ihJgigc/revefor.pdf
- https://static.s123-cdn-static.com/uploads/4454670/normal_5fe051eb89753.pdf
- https://buxivadoga.weebly.com/uploads/1/3/0/7/130740323/7072017.pdf
- https://sijevunima.weebly.com/uploads/1/3/1/8/131859613/e99b9.pdf
- https://cdn.sqhk.co/tipefimex/xjfUmjc/81268025902.pdf
- https://cdn.sqhk.co/bidubuwawi/haicFha/invaders_synonym_definition.pdf
- https://cdn-cms.f-static.net/uploads/4366374/normal_5faaa6ec9e0ec.pdf
- https://uploads.strikinglycdn.com/files/897b2504-35df-430f-8236-88dd43654a53/g_to_nanograms.pdf
- https://uploads.strikinglycdn.com/files/6202a762-a0a7-459f-b38a-89fb7d002b98/east_clinton_high_school_football.pdf
- https://uploads.strikinglycdn.com/files/28fa9982-cc39-4298-9326-17d4a0221936/afaa_personal_training_study_guide_answers.pdf
- https://uploads.strikinglycdn.com/files/b214b524-e60b-4c38-aba5-3965463b7acc/43846525159.pdf
- https://uploads.strikinglycdn.com/files/f31e9ffd-a379-40c3-b493-5e74a5c68eba/dr_seuss_clipart_png.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.