Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b024b4ef7f239b1…

MALICIOUS

PDF

47.0 KB Created: 2021-03-14 22:19:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: acbf4883b73db9ad9abd3cc1b97f702d SHA-1: 0973accd3279badfd8df468d454adc956847e348 SHA-256: 6b024b4ef7f239b1e1b36d14266f025c7a0ea1483febbc55f47637556c7ebe63
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8132

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=buku+agama+islam+kelas+x+kurikulum+2020+penerbit+erlangga+pdf PDF link annotation
    • https://cdn.sqhk.co/tamejenonisi/hIigYhc/53609828521.pdfIn PDF document text
    • http://zixivudu.getenjoyment.net/descargar_libro_de_balance_de_materia_y_energia_antonio_valiente.pdfIn PDF document text
    • https://cdn.sqhk.co/nilesatu/iliisid/losesuwepix.pdfIn PDF document text
    • http://sutarakikim.scienceontheweb.net/cecile_chaminade_concertino_flute.pdfIn PDF document text
    • http://hugertely.xyz/125419725940odyq.pdfIn PDF document text
    • http://sarkife.site/ridipubovazukujizuninxn1mz.pdfIn PDF document text
    • https://cdn.sqhk.co/xovikojux/iwejiSb/stickman_jump_shadow_revenge_mod_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/rumobotituda/hdBgdif/54930421573.pdfIn PDF document text
    • http://walkover.me/mefinajejiwatekevejiabi.pdfIn PDF document text
    • http://laulu-go.ru/atomic_and_molecular_physics_formulas79wew.pdfIn PDF document text
    • https://cdn.sqhk.co/ketodumukiv/bZXhc4V/annexure_format_offer_letter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b95ddd9-5c23-4ec4-8b41-3a57bdfa25bc/short_story_free_childrens_books.pdfIn PDF document text
    • https://50aad03f-9d2a-47e6-be13-abd12f321b17.filesusr.com/ugd/3fd638_6da9a42734b4465ca95aca7f83d96b5d.pdf?index=trueIn PDF document text
    • https://0f285ee0-1b14-49a2-8a3e-060a2db94812.filesusr.com/ugd/4bf67f_d13ddc7d73854d1192ae40f085953029.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/76573d1d-cb5d-4836-92db-bb5a737a6a3e/samsung_s4_mini_google_backup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8eeb59f5-99dd-4da8-ab99-48a7022eceaf/hannah_arendt_on_revolution_chapter_2_summary.pdfIn PDF document text
    • http://fozozip.onlinewebshop.net/blood_type_diet_chart.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9fc04a43-3d03-456a-a0f5-356fef023e2a/befadate.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd34846e-3b28-4726-8b80-8395f91396b8/34499114598.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e983722d-658e-4763-9921-7cd4063a9f26/craftsman_825_series_14_tiller_price.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.