Malicious PDF — malware analysis report

Static analysis result for SHA-256 6bf4877afca94ad3…

MALICIOUS

PDF

51.4 KB Created: 2021-05-28 05:23:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: a22648eb4e36febdd22ddf461518b387 SHA-1: c40920b9e90d32d7d6bed8a751300718c4fc9322 SHA-256: 6bf4877afca94ad379d1582077c2a98e0893b0dd6b1b1587f8deb35dc589fcdf
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many hosted on disposable domains, indicating a link farm designed to direct users to potentially malicious websites. ClamAV detected this file as Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0, and ML classification also flagged it as malicious. The primary attack pattern observed is the use of malicious links within the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9391

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wb?keyword=ezgo%20robin%20engine%20parts PDF link annotation
    • https://gepidoduxaw.weebly.com/uploads/1/3/5/3/135324144/vegopupo_dorimitubewuxib_suduto_zesel.pdfIn PDF document text
    • https://dinumaditu.weebly.com/uploads/1/3/4/4/134479473/3175482.pdfIn PDF document text
    • https://ropesafubisok.weebly.com/uploads/1/3/4/5/134515157/3666070.pdfIn PDF document text
    • https://niladituzisum.weebly.com/uploads/1/3/4/7/134736231/629b4672833e2f.pdfIn PDF document text
    • https://satemegozujig.weebly.com/uploads/1/3/4/4/134477909/linenak_bozaxani_vawowijuzavoja_pajita.pdfIn PDF document text
    • https://gapudozesaneg.weebly.com/uploads/1/3/4/5/134525911/vobuzizutivoguz-xakiwuv-memawar.pdfIn PDF document text
    • https://leronavazejobi.weebly.com/uploads/1/3/4/7/134749677/16fdc39.pdfIn PDF document text
    • https://kesadoxiluxar.weebly.com/uploads/1/3/5/9/135974677/midawujoje_bomufowip_sokilibude.pdfIn PDF document text
    • https://befadileniralan.weebly.com/uploads/1/3/6/0/136082268/9013898.pdfIn PDF document text
    • https://telanadiv.weebly.com/uploads/1/3/4/4/134495792/nifukomelixojadegor.pdfIn PDF document text
    • https://kivifakan.weebly.com/uploads/1/3/4/8/134870172/mifabogagorabijoj.pdfIn PDF document text
    • https://ginataxidorivez.weebly.com/uploads/1/3/4/0/134041929/7ce03a.pdfIn PDF document text
    • https://mazokozofifux.weebly.com/uploads/1/3/4/3/134305155/nisefodefa.pdfIn PDF document text
    • https://kedefakoriwo.weebly.com/uploads/1/3/1/1/131164231/bumogu.pdfIn PDF document text
    • https://gedenotovet.weebly.com/uploads/1/3/1/3/131379555/ff2bf1fdafe38ae.pdfIn PDF document text
    • https://jemogofeti.weebly.com/uploads/1/3/4/0/134042608/gagotugilem.pdfIn PDF document text
    • https://zizowotedudoma.weebly.com/uploads/1/3/4/6/134641453/3941324.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1baed40b-18f9-4ae5-9266-d20351017928/nodixa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbbec55b-216e-4aba-a69c-29b79985dcfb/90164893906.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2040efd2-0120-41d4-99a7-2e30dc29d6a2/how_to_get_rid_of_directions_hair_dye.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.