PDF malware analysis — malicious · 57b3ad0ee3fba1c5

MALICIOUS

PDF

54.0 KB Created: 2021-09-17 03:10:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 53e5c00bc8e2f3a2a622f9067c1fef4c SHA-1: 2e776456390987aee6fc30eefc287addcd272df4 SHA-256: 57b3ad0ee3fba1c5207dd78c70ebc08186d16dbb8a2fb140ad3b016db0b83eae

132 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains embedded JavaScript and numerous external URIs, many of which point to disposable domains, suggesting a link farm designed to redirect users to malicious content. The primary attack pattern involves leveraging these links to deliver a secondary payload or phish for credentials.

Machine Learning

Nyx PDF Classifier malicious score 0.6253

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pasarangroup1.com/contents/files/44197220641.pdf
- https://www.beewellrx.com/wp-content/plugins/super-forms/uploads/php/files/9hphnedum0ecdj1oni8e0p76io06tpef/nuvelafedasab.pdf
- https://sharkovinkom.com/sharkovinkom.com/ckfinder/userfiles/files/wajotemo.pdf
- https://consultemergingmarkets.cubsindia.com/files/pexatexabiludulefoli.pdf
- http://www.jasolasia.com/image/upload/File/febusuwu.pdf
- http://eperon-kochersberg.com/img_db/12903295426.pdf
- https://naucharts.com/ckfinder/userfiles/files/wusomubuxuzilavozosen.pdf
- http://onsijsselstein.nl/userfiles/files/xovovuboxiveken.pdf
- http://pure-chiral.com/upload/files/4443808541.pdf
- http://tc-muehlacker.de/data/tcmuehlacker/userfiles/file/xutirebekugowujuboti.pdf
- https://www.supremecaravans.com.au/application/third_party/ckfinder/userfiles/files/bepud.pdf
- http://speed-r.com/js/upload/files/94259476775.pdf
- https://lederstuehle-shop.de/ckfinder/userfiles/files/zatetirusurekebafaserexiw.pdf
- https://rafaellopezehijo.com/upload/files/zobizokasop.pdf
- http://anabakorea.jp/userfiles/file/35443976196.pdf
- http://royalrep.com/userfiles/files/9103363897.pdf
- http://askaudit.ru/price/86320176163.pdf
- http://baldonimarcostudio.eu/userfiles/files/jigikenotafelutidesaru.pdf
- http://christopherspubandgrille.com/userfiles/files/lozevewinis.pdf
- https://dhrc.in/userfiles/file/binowomefub.pdf
- http://cs-web-design.de/ablage/userfiles/files/79097111433.pdf
- https://perfecthospital.org/ckfinder/userfiles/files/jovoxaboxo.pdf
- http://mcap.cz/images/uploadedimages/file/rekerisuminid.pdf
- http://www.lnk-creation.fr/upload/file/37725023055.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=can+i+transfer+my+clash+royale+account+from+android+to+iphone

Open this report in the interactive analyzer, or submit your own file for analysis.