Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d9659dd8921bf21…

MALICIOUS

PDF

55.8 KB Created: 2021-03-23 19:55:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 1a00c7d555357d5e1875a4c2ab55ff8d SHA-1: ecb2743dd7e7bb117767001964c8d458d084ddc9 SHA-256: 7d9659dd8921bf21b173dde6132f014f4814ceb6f7fcb0b37316de51145b33cb
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6222

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=ielts+speaking+band+descriptors+pdf PDF link annotation
    • https://gokaletuwatuni.weebly.com/uploads/1/3/6/0/136098233/1398040.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489993/normal_5ff3bfee08a7b.pdfIn PDF document text
    • http://inglassrus.ru/how_to_check_gigabyte_motherboard_serial_numberyzasm.pdfIn PDF document text
    • https://cdn.sqhk.co/fulaxanew/hsgfjc8/daiwa_double_clutch_lures_bcf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455179/normal_6013350b95420.pdfIn PDF document text
    • http://spainsale.pro/summary_of_novel_sense_and_sensibility_by_jane_austen234x7.pdfIn PDF document text
    • https://xikagarema.weebly.com/uploads/1/3/4/4/134489929/xuxawogimotam.pdfIn PDF document text
    • http://igcopyrightclient.com/sample_keto_breakfast_recipes95oqx.pdfIn PDF document text
    • https://gerasulas.weebly.com/uploads/1/3/4/8/134861388/5cf35ec0838d2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474752/normal_5fe5aeb918f45.pdfIn PDF document text
    • https://cdn.sqhk.co/xuvisisitinu/hcjdjh6/steel_and_flesh_2_new_lands_mods.pdfIn PDF document text
    • https://tugofemupufere.weebly.com/uploads/1/3/4/5/134584107/45124.pdfIn PDF document text
    • https://tijirurilulade.weebly.com/uploads/1/3/4/3/134312421/gawonifulexipezizoni.pdfIn PDF document text
    • https://cdn.sqhk.co/moturalogupe/88haJAY/11654967528.pdfIn PDF document text
    • https://cdn.sqhk.co/gaxumisi/hfuHUii/every_valley_john_ness_beck_lyrics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6f34741-c9e7-4a4b-b54b-54d4eeba40f8/wsjt_x_2.3.0.pdfIn PDF document text
    • https://d80868e2-5d34-4dda-9345-0396294a35aa.filesusr.com/ugd/f9fac6_ae371a03c3ea4c2aa618aca47f5b0ab6.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b21bcdf-0f6a-422a-84bf-33234d80d9d4/what_happens_in_the_first_stave_of_a_christmas_carol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e416284-b677-441e-98a9-fab2aa99dc0d/14485274916.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25070c2e-467f-47b1-986e-1d28d8289d33/cuanto_equivale_metro_cubico_en_litros.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f54a6010-9e96-4042-8ebc-823683415eb7/karoj.pdfIn PDF document text
    • https://933527c5-e005-4225-a3aa-05fee46c7696.filesusr.com/ugd/b51dd5_daae48f461d74a988fb4342a6772ba68.pdf?index=trueIn PDF document text