Malicious PDF — malware analysis report

Static analysis result for SHA-256 6595aa02dde6e906…

MALICIOUS

PDF

54.0 KB Created: 2021-02-28 19:10:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 542f4e92e53ce26c614d309008c25566 SHA-1: e296e081b3ade912fca5065104b553115064d97d SHA-256: 6595aa02dde6e906e085f816e510de00fc20b5d1d907a424dbcaf356a22e8516
182 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links that redirect to known malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier and ClamAV also flagged this file as malicious. The document body, though heavily obfuscated, suggests a lure related to installing security cameras, which is then linked to a malicious domain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6313

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=how+to+install+zmodo+wireless+security+cameras In PDF document text
    • http://romikemixukoj.iblogger.org/41231183981.pdfIn PDF document text
    • https://jibizixowaxen.weebly.com/uploads/1/3/5/2/135296653/6cef50f12bb7275.pdfIn PDF document text
    • http://taxiralimivi.iblogger.org/android_games_like_diablo_2.pdfIn PDF document text
    • http://jikalananigopun.iblogger.org/rugekelafuf.pdfIn PDF document text
    • https://votokivefanatu.weebly.com/uploads/1/3/1/4/131453133/rofoku.pdfIn PDF document text
    • https://gavuwili.weebly.com/uploads/1/3/1/0/131070236/nopezujudejit_kitedavigosazik_kedawuwasivala.pdfIn PDF document text
    • https://letotanuvimipe.weebly.com/uploads/1/3/4/5/134598603/kenefudutoperi.pdfIn PDF document text
    • http://noluboxemefosa.epizy.com/wavilewazofesizopasat.pdfIn PDF document text
    • https://s3.amazonaws.com/pibabopuduj/letad.pdfIn PDF document text
    • https://s3.amazonaws.com/jebokizez/badib.pdfIn PDF document text
    • http://wiwekire.epizy.com/gipimumabesavumozusok.pdfIn PDF document text
    • http://tasopawak.rf.gd/where_is_the_backup_buzzer_on_a_ezgo_golf_cart.pdfIn PDF document text
    • http://tununik.epizy.com/botubokigamutinapomutus.pdfIn PDF document text
    • http://tolibewi.epizy.com/answer_machine_messages_funny.pdfIn PDF document text
    • http://nivitigu.epizy.com/semerumijafufiwo.pdfIn PDF document text
    • http://tixozusapojujuj.rf.gd/7181466006.pdfIn PDF document text
    • http://lanakupi.epizy.com/flowers_for_algernon_theme_song.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.