Malicious PDF — malware analysis report

Static analysis result for SHA-256 612056dba7d4cac0…

MALICIOUS

PDF

67.9 KB Created: 2021-03-29 12:04:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 7316b75f8a4908a2a6a211e7a51fbf83 SHA-1: 07aceee8c0f1992fc992132910f1efb01df581da SHA-256: 612056dba7d4cac0614ec3f1aa105788f7153fcf8bd3959f37d9b29ab5ff68bf
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, many pointing to disposable hosting, and is detected as a phishing/trojan by ClamAV. The document body, though heavily obfuscated, includes a URL that appears to be a search query for educational materials, suggesting a lure to disguise the malicious intent. The presence of multiple PDF link farm heuristics indicates a coordinated effort to distribute links, likely for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5221

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=9th+class+chemistry+notes+pdf+free+download PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4465259/normal_5fd08f2a0d4d3.pdfIn PDF document text
    • http://boost-store.net/34059562348k59ha.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478716/normal_605d8682263c3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470523/normal_605d8d0837e37.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419849/normal_6059f8646ff47.pdfIn PDF document text
    • https://cdn.sqhk.co/gudijupimeb/aIUzi61/houston_color_run_route.pdfIn PDF document text
    • https://cdn.sqhk.co/suxupijisajo/iPzjjsb/strategic_management_book_pearson.pdfIn PDF document text
    • http://greatholl.com/71445125154cs6bl.pdfIn PDF document text
    • https://cdn.sqhk.co/duvapegoleva/wohiJhe/zokepegenanikubovapukosuf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378613/normal_60532b5f9829d.pdfIn PDF document text
    • https://cdn.sqhk.co/niramojiga/fijJmih/mazujunamidewotaxoz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413238/normal_605951a1b6458.pdfIn PDF document text
    • http://hr-insider.com/ripaji6z696.pdfIn PDF document text
    • http://pornbustyvids.com/spectrochimica_acta_part_a_molecular_and_biomolecular_spectroscopyllz4p.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495039/normal_6056273baa9b8.pdfIn PDF document text
    • https://cdn.sqhk.co/dulunukosep/gehC2Hl/lagu_barzanji_marhaban.pdfIn PDF document text
    • https://6c892e0d-5736-4b4a-96a3-cd490fd1fe3d.filesusr.com/ugd/1407cd_0310ef3171b649d1a0fc7860c6eb5eb4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wujodibu/cgt_tax_guide.pdfIn PDF document text
    • https://a95edb9d-21e5-46e4-bb1b-b1fdf66a5dae.filesusr.com/ugd/09e34a_8368ba39309b4f66bde9fe7a5972324b.pdf?index=trueIn PDF document text
    • https://3f7ff619-1e23-491c-a925-ddda4d79b49c.filesusr.com/ugd/79c22a_6ff637fea5da4088b9e0a2a0914e8441.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vovopafubipu/goaliath_54_prodigy_in-ground_basketball_hoop_installation_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/pilazi/jofojopufola.pdfIn PDF document text
    • https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_af68d5f400734f399f3f53e37a4bb927.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/rolejasomepevef.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.