Malicious PDF — malware analysis report

Static analysis result for SHA-256 69971a5292518372…

MALICIOUS

PDF

57.2 KB Created: 2021-03-03 21:31:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: d792c2527c9da3c9cd3e1bb032e38d69 SHA-1: 835fd1e6422c563aada24962befaf6fac97c0157 SHA-256: 69971a529251837284e9c9f4d96b2100a37008a5d2ed5ca64adc3a16bf76e6ba
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6975

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=lenovo+thinkpad+t420s+ram+upgrade PDF link annotation
    • https://wibugosavuzatug.weebly.com/uploads/1/3/4/3/134349607/lukudawotanak-lepuno.pdfIn PDF document text
    • http://menbp.online/gozososejuxewhtvj1.pdfIn PDF document text
    • http://connexion-amelii.xyz/oticon_hearing_aid_appgxkdd.pdfIn PDF document text
    • http://pukebebizadolu.mypressonline.com/gezugutesi.pdfIn PDF document text
    • http://verifedform.com/technical_chart_analysis_bookf381l.pdfIn PDF document text
    • https://tapuroxoj.weebly.com/uploads/1/3/4/5/134599682/1191111.pdfIn PDF document text
    • https://dinabowufijub.weebly.com/uploads/1/3/4/7/134751612/goxamupudigagi.pdfIn PDF document text
    • http://tekdouche.xyz/zonosizezuterafewbjqe0.pdfIn PDF document text
    • https://towipikegogu.weebly.com/uploads/1/3/4/6/134690187/548380c551701e.pdfIn PDF document text
    • http://hookup157.fun/junubuzivasumaxofavifa86glf.pdfIn PDF document text
    • http://gedadekenoz.mywebcommunity.org/17645489960.pdfIn PDF document text
    • http://worldhold.online/ncert_9th_class_science_book_solutions_chapter_573hy0.pdfIn PDF document text
    • http://shoop-fm.ru/imagenet_dataset_size8o4f5.pdfIn PDF document text
    • http://koxolavomuzo.myartsonline.com/hp_laserjet_m1212nf_mfp_scanner_driver_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/resisuna/agneepath_old_movie_full_hd.pdfIn PDF document text
    • https://s3.amazonaws.com/tapexiw/linking_words_lesson_plan.pdfIn PDF document text
    • https://s3.amazonaws.com/libusamagowuvo/pillars_of_eternity_2_deadfire_dlc.pdfIn PDF document text
    • https://s3.amazonaws.com/teximikamukubo/nukijipegosojawanikemepe.pdfIn PDF document text
    • https://s3.amazonaws.com/sonutopexaramuf/41260489920.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.