Malicious PDF — malware analysis report

Static analysis result for SHA-256 59892d876e41f446…

MALICIOUS

PDF

55.8 KB Created: 2021-03-21 22:15:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e4d0e0083e1fda52dc813133e179d140 SHA-1: d0c31da6aea493c9e340175cfad478251d641d0d SHA-256: 59892d876e41f4467763e93af3b350aa3ab076164c9124bcd2631458adcfebce
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. It contains a large number of external links, many of which are SEO-themed, suggesting a link farm or spamming operation. The primary external URL, 'https://soxebez.ru/award?keyword=ampere+s+circuital+law+pdf', indicates a lure related to academic content to attract clicks. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9084

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=ampere+s+circuital+law+pdf
    • https://bimomudunaxa.weebly.com/uploads/1/3/4/7/134757379/1405394.pdf
    • http://lbaranaydin.com/penalty_kick_movie_reviewps4r2.pdf
    • http://dream-stat.ru/464895665456zd7r.pdf
    • http://legugoboxebepe.22web.org/zorefisibalagexibadevod.pdf
    • http://remont-kholodilnikov.website/bewars_movie_song_in_telugui1jsk.pdf
    • http://guitar.su/is_it_ok_to_take_a_nap_while_wearing_contact_lensesybgch.pdf
    • https://vabusidi.weebly.com/uploads/1/3/4/7/134765039/xadawokexi.pdf
    • https://ridogorizaloliv.weebly.com/uploads/1/3/4/5/134527302/nivava-dekija.pdf
    • https://karuxuli.weebly.com/uploads/1/3/4/3/134377251/mawefo.pdf
    • http://minuette.me/737254920754pgh6.pdf
    • https://uploads.strikinglycdn.com/files/b22c6efd-d4ab-4f69-833c-a2e3f9c7b530/buzogedarusasas.pdf
    • https://uploads.strikinglycdn.com/files/096e4424-16ee-4ba3-994d-eec6a66de3f3/how_to_clean_drain_pump_in_bosch_washing_machine.pdf
    • https://uploads.strikinglycdn.com/files/f085b4b0-62a4-4359-bc90-4b314dc50ea4/how_to_setup_avaya_voicemail.pdf
    • https://uploads.strikinglycdn.com/files/88748e3b-e72c-40c4-8580-23c7183452bd/beautiful_creatures_novel_series_in_order.pdf
    • https://s3.amazonaws.com/fedojigudaj/77615376991.pdf
    • https://uploads.strikinglycdn.com/files/da051c7c-0f78-40cb-999f-c6988a8ea8f3/what_is_the_difference_between_critically_evaluate_and_critically_analyse.pdf
    • http://nokivegodixisi.rf.gd/genetics_basics_2000_answer_key.pdf
    • https://s3.amazonaws.com/xovekolamoxe/chitrangada_bengali_movie_free.pdf
    • https://s3.amazonaws.com/rizezobabub/pressure_conversions_chem_worksheet_13-1_answer_key.pdf
    • https://s3.amazonaws.com/bomupi/bahubali_full_movie_online.pdf
    • https://s3.amazonaws.com/rakabexozu/scholastic_aptitude_test_questions_with_answers_2018.pdf
    • http://fixadamobus.epizy.com/new_bhakti_song_ringtone_free.pdf
    • https://s3.amazonaws.com/vipuxafol/15916964979.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.