Malicious PDF — malware analysis report

Static analysis result for SHA-256 5af2463661dceabe…

MALICIOUS

PDF

94.2 KB Created: 2021-04-27 14:20:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: f5e2c37aae9aa78e8146b222c3dbdec3 SHA-1: 0388cbe1629a026e16a32ab8c250a46cbac8736c SHA-256: 5af2463661dceabe57313123838c09127f5582004d6f1cc7e52adc70e98614e8
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URIs, with one pointing to a suspicious domain ('dugedepap.ru') that is likely part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded links suggest it's designed to redirect users to malicious content, likely for phishing or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6535

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=maximum+normal+stress+theory+%25E4%25B8%25AD%25E6%2596%2587 PDF link annotation
    • http://bajesiradevo.getenjoyment.net/dofotapunomuvafesup.pdfIn PDF document text
    • http://allroadkamchatka.ru/how_to_structure_a_real_estate_syndication_deal0oqoj.pdfIn PDF document text
    • http://jejederepox.medianewsonline.com/calendario_2020_anual.pdfIn PDF document text
    • http://allroadkamchatka.ru/zikutukubinelafinidonow6pvu8.pdfIn PDF document text
    • http://wisitens.online/dozerolakavikolijabzgpb.pdfIn PDF document text
    • http://tometifo.getenjoyment.net/vujam.pdfIn PDF document text
    • http://xegazinijitup.mywebcommunity.org/now_taking_boyfriend_applications.pdfIn PDF document text
    • http://fb-copyright-help-from.com/78860324019dytcr.pdfIn PDF document text
    • http://fb-ig-copyright.com/white_nights_dostoevskym6bqq.pdfIn PDF document text
    • http://lasiwefomibew.sportsontheweb.net/13948680566.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/224154ba-e92a-4b50-ad3e-1229cb2a851e/2002_ford_explorer_sport_starter_relay.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d2aac27-b481-431d-bb9e-2314d9467849/club_car_precedent_seats.pdfIn PDF document text
    • https://3568ea06-17fa-4787-91ae-86b9aa918cbd.filesusr.com/ugd/8ade13_7b164305b1d84b1f810af15a296e2193.pdf?index=trueIn PDF document text
    • http://rixuroruwe.myartsonline.com/crestron_cen_swpoe_16.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc5d90bc-738d-4362-8260-fa33b1e65704/47436318512.pdfIn PDF document text
    • https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_0878630f91c04b2190198d56ed900edb.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a28b070a-d33a-421c-9b71-073351fcef08/55184370230.pdfIn PDF document text
    • https://394fded3-a37f-45fe-8092-07e0884d2d31.filesusr.com/ugd/bdbc91_ccac3b0721be4aaba20e1cea6416e369.pdf?index=trueIn PDF document text
    • https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_ce5a9485d37941faa71404465e101647.pdf?index=trueIn PDF document text
    • http://tevaluzax.atwebpages.com/12647862247.pdfIn PDF document text
    • http://kepofif.onlinewebshop.net/audio_technica_at-lp60x_belt_drive_turntable_review.pdfIn PDF document text
    • https://8641c524-1fb5-4292-87ed-dd72f64d6c22.filesusr.com/ugd/9b7d8a_4f38cd7975ab4f549c039b3ffb20053c.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eef2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEF2 25796 bytes
SHA-256: 00506f9283087ddb6b58d9ed5a2cbe8d04497930e859d5f2f04c9f2185535ad5
font_01_sfnt_off00013dda.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13DDA 3112 bytes
SHA-256: bd0215a9923d8f4b7e9ab04648888f3c37a07a91c8686d37b0fb78c1db002805
font_02_sfnt_off000148df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x148DF 5100 bytes
SHA-256: a46a2ad40f7465ae0306739bd23d41cb4b0a4a93976081e109fd64e9aac65f25

Open this report in the interactive analyzer, or submit your own file for analysis.