PDF malware analysis — malicious · 7347f00e993248f6

MALICIOUS

PDF

42.8 KB Created: 2021-09-27 10:42:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: dde41add3b1294be84a9a117fc7f76f5 SHA-1: 94f3baa591fd783d45a8bbe3beacfb3517e787b5 SHA-256: 7347f00e993248f685e1ef7abbdc749ce9af2df6a5a4449880eb1afbeb76447b

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF was flagged by ML classifiers and ClamAV as malicious. It contains numerous embedded URLs, with one specifically identified as a link farm on disposable hosting. The presence of these links suggests an attempt to redirect the user to a malicious site, likely for phishing or to download further malware. No scripts were extracted, but the PDF structure and embedded links are indicative of a malicious lure.

Machine Learning

Nyx PDF Classifier malicious score 0.8437

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://abwferrellpkwy.com/uploads/files/lelawirexewivapofabuk.pdf In PDF document text
- http://bighost.vn/uploads/userfiles/file/5938710747.pdfIn PDF document text
- http://melabo.com/upload/files/tadunapafuvax.pdfIn PDF document text
- http://onroerendgoedindex.nl/images/uploads/74112521000.pdfIn PDF document text
- https://motoquadro.de/userfiles/file/72172178578.pdfIn PDF document text
- https://www.shopveriamici.com/wp-content/plugins/super-forms/uploads/php/files/r475e4454n7c5g17robosbikkb/gogekatuw.pdfIn PDF document text
- http://videlec.be/ressource/file/nibivezizedekigisov.pdfIn PDF document text
- https://solidpractise.com/files/userfiles/file/10084741128.pdfIn PDF document text
- http://gleb777.com/fck_upload/file/jofabalaxutozafodefa.pdfIn PDF document text
- http://camonetinternational.com/files/file/rapewokedulivib.pdfIn PDF document text
- https://tecnibat.net/uploads/archivos/nunufirogowegadefadajola.pdfIn PDF document text
- https://megashina24.ru/files/files/gafipibuguxugokixutidob.pdfIn PDF document text
- http://yds-wcv.jp/free_images/files/vamenonepazale.pdfIn PDF document text
- https://aiwcecckolkata.org/FCKeditor/file/50835831124.pdfIn PDF document text
- http://wx-test.com/upload/ckimg/files/202109190514531625.pdfIn PDF document text
- https://ferropula.hr/files/19722082005.pdfIn PDF document text
- http://lpxs168.com/filespath/files/20210904054725.pdfIn PDF document text
- https://tainandentist.com/uploads/files/202109230712191504.pdfIn PDF document text
- http://jimsclub.net/new/board/img_tinfo/file/20210911130835.pdfIn PDF document text
- https://takarasushimn.com/userfiles/files/3685015916.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/GLLx1DTH0VQ/uplcv?utm_term=android+gangstar+rio+city+of+saintsPDF link annotation
- http://cluster006.ovh.net/~greeters/be/ckfinder/userfiles/files/wasulawobeletitokago.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.