Malicious PDF — malware analysis report

Static analysis result for SHA-256 570f48e784991942…

MALICIOUS

PDF

46.2 KB Created: 2021-03-29 21:22:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 079a2e60d006f48037766b28d2791e72 SHA-1: 6824198a442d2819563f093a42dde01290b09e46 SHA-256: 570f48e784991942a0c4b1eeea33012730606cd0d11ad132b43e6a4605842af4
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7172

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=pdf+scanner+software+canon+lide+110 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4418764/normal_5ffca0026e00f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4528876/normal_60512e95b11da.pdfIn PDF document text
    • https://abbf68a8-5b21-4996-91be-11266bd273ed.filesusr.com/ugd/9374a7_f6eb2896e0944141890a316ad10eb649.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xefezesebusu/27474179468.pdfIn PDF document text
    • http://matewedidoxeber.onlinewebshop.net/nomaxidajor.pdfIn PDF document text
    • https://s3.amazonaws.com/rupatojuko/57863673712.pdfIn PDF document text
    • https://f6ea5e03-7e7c-4dce-82ee-fd5d223759ef.filesusr.com/ugd/d203ad_d4abf212fd4d41539e79719e3bfd4099.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sakaburepagase/noguguwijamoj.pdfIn PDF document text
    • http://ginowane.onlinewebshop.net/rolajipobapavufugolugox.pdfIn PDF document text
    • https://s3.amazonaws.com/fizup/gipavatuzepitili.pdfIn PDF document text
    • https://s3.amazonaws.com/bomupi/gekopoli.pdfIn PDF document text
    • https://s3.amazonaws.com/jajoxulabojaso/microsoft_365_user_guides.pdfIn PDF document text
    • https://s3.amazonaws.com/benubapopikaj/23074849939.pdfIn PDF document text
    • https://s3.amazonaws.com/nefomojuwet/bharat_ke_veer_song_free.pdfIn PDF document text
    • https://s3.amazonaws.com/sebunuzu/45081537386.pdfIn PDF document text
    • https://s3.amazonaws.com/megodipewukitoj/zanigojo.pdfIn PDF document text
    • https://s3.amazonaws.com/vuzotisenixava/tv_series_online_reddit.pdfIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.