Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ede99bbac73ccc6…

MALICIOUS

PDF

52.6 KB Created: 2021-03-25 15:07:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 4c272d64a8d7724c0d51f254b9fad975 SHA-1: 84b2ada4aef2269eae11b9e740470846731ec3ad SHA-256: 7ede99bbac73ccc6a521275a7a5f119346422b0eeba0eb77db77cc47eb06b0ed
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was identified as malicious by multiple heuristics and a machine learning classifier, with ClamAV detecting it as Pdf.Phishing.Trojan. The file contains a large number of external links, many hosted on disposable domains, suggesting it functions as a link farm designed to redirect users to potentially malicious content. The document body, though heavily obfuscated, appears to be a lure related to a book title, likely to encourage clicks on the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7206

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=biblia+de+estudio+para+la+mujer+nvi+leather+soft%252Ftela+lila PDF link annotation
    • https://cdn.sqhk.co/wupifufexix/55jcdjb/rufozimajid.pdfIn PDF document text
    • https://cdn.sqhk.co/vuwibagula/fIgfAMe/triangle_angle_bisector_theorem.pdfIn PDF document text
    • https://cdn.sqhk.co/lutakakijuro/gjEUjhp/nolesareta.pdfIn PDF document text
    • https://cdn.sqhk.co/runusamopit/riiwjgj/13441232765.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae5ba9f7-6be0-4308-afec-8d97a9c2d7f2/20992752092.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4bc758d7-8f8d-445e-9ecd-276cc0ed68e9/27380736245.pdfIn PDF document text
    • https://e9b66cc5-9289-431c-8f17-6739e1cd2d88.filesusr.com/ugd/c8f33b_d84211de3c65441b913bcd182a7f84a0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/26e0d563-52e2-42d5-8160-9929e8f5641d/10963012187.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42ad3bd4-2099-49db-973c-895d47f6a617/73016380859.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/040f356e-c2f5-49bc-9509-2889c5d35bd0/taxukukukuvomin.pdfIn PDF document text
    • http://wiwazojugumume.epizy.com/7th_class_english_textbook_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5472a3c9-99a6-4cd9-91a6-fe430af2ac54/39330629355.pdfIn PDF document text
    • https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_fa23178e28154065bf80f8dc9b71a3a4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d35d9122-ae5f-470a-ad0c-0dc944da3782/side_by_side_third_edition_book_2_activity_workbook.pdfIn PDF document text
    • http://majoxokusixapav.epizy.com/senujemipefizine.pdfIn PDF document text
    • https://7a1f2a0d-094a-4466-88af-72a4af93b9fa.filesusr.com/ugd/22739b_717af066709548f7940408a1e9df86b7.pdf?index=trueIn PDF document text
    • https://47a25507-5c4f-4e73-9b7c-0c49514c8174.filesusr.com/ugd/e00bd3_039f728657ac49cb8a2e41fd3ae2bf40.pdf?index=trueIn PDF document text
    • https://7ffe38df-ef78-47a1-8632-a9c579db478a.filesusr.com/ugd/8ff694_c4fc93da2bb44e6186f3ed4bc72954a2.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/46191e45-e2ed-49c2-8039-f35b6a1ebe58/best_books_for_gmat_preparation_2020.pdfIn PDF document text
    • http://pogelejulogowev.rf.gd/15_day_weight_loss_challenge_day_4.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.