Malicious PDF — malware analysis report

Static analysis result for SHA-256 767a8da8b11ec6c6…

MALICIOUS

PDF

59.9 KB Created: 2021-02-27 15:42:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 230ccfedb1e58dbaa0b2b8a840c79312 SHA-1: fd9667df99a221320ffde7dcbba08251b575a760 SHA-256: 767a8da8b11ec6c602351e9e9d58fdb3ab843985bcf089d206eac91b542f8543
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, including a high ML score and ClamAV detection. It contains numerous embedded URLs, many of which point to disposable hosting and appear to be part of a link farm. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create malicious PDFs. The presence of external URIs and the link farm structure strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9369

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=marine+corps+silent+drill+team+throwing+rifles PDF link annotation
    • https://cdn.sqhk.co/xenivoronizu/jfRgerg/9678476736.pdfIn PDF document text
    • https://cdn.sqhk.co/lulaxujik/fxtjd8w/bream_fishing_rigs.pdfIn PDF document text
    • http://mail-autoscout24.net/viewpager_in_fragment_androidimqoi.pdfIn PDF document text
    • https://lubagevaruzazej.weebly.com/uploads/1/3/2/7/132712663/ziwanazox.pdfIn PDF document text
    • http://replyua.site/fiat_punto_service_manualzi1hm.pdfIn PDF document text
    • http://optalpha.com/50676124346uzyrr.pdfIn PDF document text
    • https://mogatuzutixu.weebly.com/uploads/1/3/4/6/134684840/damuduvexevarotez.pdfIn PDF document text
    • http://kedugobepuged.mywebcommunity.org/47737154490.pdfIn PDF document text
    • https://cdn.sqhk.co/dogutadova/hihfigB/ghost_hunters_classic_hulu.pdfIn PDF document text
    • https://finubakexa.weebly.com/uploads/1/3/1/3/131383318/virunidamatusupo.pdfIn PDF document text
    • http://robugipunebib.mygamesonline.org/samsung_tablet_ce0168_battery_removal.pdfIn PDF document text
    • http://xojuxelase.medianewsonline.com/pobelema.pdfIn PDF document text
    • http://lajodibibodi.getenjoyment.net/which_narnia_movie_comes_first.pdfIn PDF document text
    • https://s3.amazonaws.com/busutafitufe/adobe_premiere_elements_2020_video_editing_tutorial.pdfIn PDF document text
    • http://zonatitusajobo.onlinewebshop.net/i_am_not_okay_with_this_book_barnes_and_noble.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.