Malicious PDF — malware analysis report

Static analysis result for SHA-256 63c08cdd0e0a04b6…

MALICIOUS

PDF

50.6 KB Created: 2020-12-16 22:45:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 13ca39f9251a9506e5beda89ff14ebeb SHA-1: 577002bd7d37fd55fb6f076107225e29c9c23309 SHA-256: 63c08cdd0e0a04b692d1f9b1baf42a99aec68b3c3f99cf39b1a7858edccdb575
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-only content and embedded action trigger, typical of a screenshot lure. It contains a mass external PDF link farm, with several URLs pointing to potentially malicious content. The ClamAV detection and ML classifier further support its malicious nature, indicating it's likely a trojan designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6878

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=coc+th7+strategy+attack
    • https://dufejubodumafeb.weebly.com/uploads/1/3/4/4/134444341/vironesizami.pdf
    • https://bukivobiwizu.weebly.com/uploads/1/3/4/0/134097020/fipuxa.pdf
    • https://gokopawe.weebly.com/uploads/1/3/4/4/134493337/4589730.pdf
    • https://korebamo.weebly.com/uploads/1/3/0/7/130739662/bomavi_jisumufebebi_medafokojikuja_velurekuzune.pdf
    • https://pozimetotekiv.weebly.com/uploads/1/3/4/3/134339641/6de4199474.pdf
    • https://titenukom.weebly.com/uploads/1/3/4/5/134523185/6177109.pdf
    • https://s3.amazonaws.com/webipejonavuv/kivuruwugaranokegoripa.pdf
    • https://uploads.strikinglycdn.com/files/d22cb57d-0c6e-4c6d-b15c-29fb6ddc6ce7/the_paris_architect_audiobook.pdf
    • https://uploads.strikinglycdn.com/files/dd8be03d-29bd-4739-ba47-b022ea1665fc/xafaseturi.pdf
    • https://uploads.strikinglycdn.com/files/25678a23-4b30-4500-9013-f96fad9a5c39/33997233555.pdf
    • https://s3.amazonaws.com/likadojivivofu/manual_do_ar_condicionado_porttil_philco.pdf
    • https://uploads.strikinglycdn.com/files/ee400c82-0e01-4c8e-91bf-72bfe91554b3/milwaukee_band_saw_6230_parts.pdf
    • https://uploads.strikinglycdn.com/files/b04e4850-4ce9-4775-82b6-355d8b3c5b65/chris_brown_no_guidance_lyrics_video_download.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.