Malicious PDF — malware analysis report

Static analysis result for SHA-256 5545177a265f5166…

MALICIOUS

PDF

56.8 KB Created: 2021-03-08 21:04:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 41037295cec18cce1069bbeea43b4a13 SHA-1: 543cd459c57768b866bd7acbd5851c4ec489afd8 SHA-256: 5545177a265f516683abfc92c160439c0641467026517226cb1b61b8a1efb6c3
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing operation. The ClamAV detection and ML classifier also indicate malicious intent. While no scripts were extracted, the PDF structure and embedded URLs point towards a phishing or malware distribution attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6222

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=selenium+eclipse+tutorial+java+pdf PDF link annotation
    • https://cdn.sqhk.co/fogibadeku/ejjeSWB/xiwagibuxikojidasovixusal.pdfIn PDF document text
    • http://kifejuja.medianewsonline.com/xufarotalanuduxojuz.pdfIn PDF document text
    • http://kadanamo.iblogger.org/zukurevo.pdfIn PDF document text
    • http://vuwefedope.sportsontheweb.net/how_fast_does_a_person_fall_from_100_feet.pdfIn PDF document text
    • http://sezejawi.mypressonline.com/14658580648.pdfIn PDF document text
    • http://gelufose.scienceontheweb.net/27944897007.pdfIn PDF document text
    • http://xoxuvajes.mywebcommunity.org/las_mujeres_que_aman_demasiado_resumen.pdfIn PDF document text
    • https://cdn.sqhk.co/dewufidabo/cgijcgj/apple_watch_3_charger.pdfIn PDF document text
    • http://vazagitomis.mypressonline.com/my_att_u_verse_guide_says_getting_information.pdfIn PDF document text
    • https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_ce2d67d80d7c46339aa6fbbc4c68a0be.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f188eff2-93b2-47d1-b050-a9ee504d899b/wipalaronal.pdfIn PDF document text
    • http://mirokuf.rf.gd/fiwutepag.pdfIn PDF document text
    • https://eff7b67d-fef5-45b7-bcd6-ffb1b71d3a14.filesusr.com/ugd/b4c9df_83f8af90fb334300b7dd007841e97309.pdf?index=trueIn PDF document text
    • https://3b0fe5ff-7f86-489c-8138-fc984e51136c.filesusr.com/ugd/bfd78a_0e4725d333574512ab8e12ced280649e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2722567d-cf5b-448d-8019-94a426526a19/what_is_the_best_2_cycle_oil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50fde56b-8ff0-4ed8-8b3b-48f6f6c12a06/english_conversation_app.pdfIn PDF document text
    • http://sujotoginejo.rf.gd/define_gaming_platform.pdfIn PDF document text
    • https://f39f7cea-6337-46de-af4f-699959e6db0a.filesusr.com/ugd/004672_296fa5a0ac8645dab63992e16f51f28e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdad27d6-8eee-423e-98a1-0c0af11be12a/8348736722.pdfIn PDF document text
    • http://wategasinoname.rf.gd/78117594118.pdfIn PDF document text
    • http://zoratamit.epizy.com/behind_closed_doors_idiomatic.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8fec7e79-92d7-4e25-abc6-541a97572dee/ford_mustang_shelby_gt350_max_speed.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.