Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e2ef302b830ab45…

MALICIOUS

PDF

69.6 KB Created: 2021-01-10 00:50:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: dcb8508d975141bc29f2f210969a6ded SHA-1: 516cf6b0745e7a50a021a93a0e30834ab308380b SHA-256: 7e2ef302b830ab4598cfbac6b2e6656b3ac8bd7cb9a3dc312b275f472ad13cea
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains numerous embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, appears to be a lure related to 'Beauty plus camera free for laptop'. The presence of a link farm and a critical heuristic firing for malicious redirectors strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8846

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?utm_term=beauty+plus+camera+free++for+laptop In PDF document text
    • https://finubakexa.weebly.com/uploads/1/3/1/3/131383318/4795214.pdfIn PDF document text
    • https://site-1176393.mozfiles.com/files/1176393/seraw.pdfIn PDF document text
    • https://site-1172568.mozfiles.com/files/1172568/mimpi_teman_hamil_artinya_apa.pdfIn PDF document text
    • https://nolujamikudaze.weebly.com/uploads/1/3/4/8/134868466/xilevuritufa.pdfIn PDF document text
    • https://site-1175524.mozfiles.com/files/1175524/colonized_map_of_africa.pdfIn PDF document text
    • https://sitoluvumoroge.weebly.com/uploads/1/3/4/7/134762666/78259a6fd50f509.pdfIn PDF document text
    • https://supavutoni.weebly.com/uploads/1/3/4/7/134713891/8609806.pdfIn PDF document text
    • https://jaketomerinojox.weebly.com/uploads/1/3/4/1/134109184/jumojosusigafin.pdfIn PDF document text
    • https://s3.amazonaws.com/toniseligiwuzux/rinojixazaxugenirivizizu.pdfIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/background_red_yellow.pdfIn PDF document text
    • https://s3.amazonaws.com/bejenosugede/dabafuwazabimuzep.pdfIn PDF document text
    • https://s3.amazonaws.com/dinilederu/tapumugomegor.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.