PDF malware analysis — malicious · 825b126e905ebb4c

MALICIOUS

PDF

59.3 KB Created: 2020-11-18 11:49:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ca1c1c77af206546dd5b1672193982b1 SHA-1: 4a184de74509726702de394a37961a03a12f0d4a SHA-256: 825b126e905ebb4ca9a36ac4654ba5d3b75f80fefd778d35ac88881201e4ffc9

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains an embedded URI pointing to a suspicious domain, identified by heuristics as a link farm on disposable hosting. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. Although no scripts were extracted, the presence of a malicious URL suggests an attempt to redirect the user to a compromised site.

Machine Learning

Nyx PDF Classifier malicious score 0.6609

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/strik?utm_term=exemple+de+business+model+canvas+pdf
- https://zabaparadasikid.weebly.com/uploads/1/3/4/3/134317604/9590674.pdf
- https://gixapogaruxa.weebly.com/uploads/1/3/4/3/134331356/2058936.pdf
- https://fumifopimon.weebly.com/uploads/1/3/4/4/134464078/8990845.pdf
- https://dilenobepaw.weebly.com/uploads/1/3/4/6/134662491/zited-jorutoloxode.pdf
- https://wetuxabo.weebly.com/uploads/1/3/0/8/130873937/gawoxixagixeb.pdf
- https://xedaliwim.weebly.com/uploads/1/3/1/4/131454603/6452702.pdf
- https://tipuvativojodud.weebly.com/uploads/1/3/4/7/134754547/wegek.pdf
- https://malalufapavi.weebly.com/uploads/1/3/4/4/134481779/1745488.pdf
- https://uploads.strikinglycdn.com/files/eb642a3e-9f71-4eb1-8d63-778cc5f3860f/big_chungus_vs_thanos_gif.pdf
- https://uploads.strikinglycdn.com/files/7217f767-499a-49c9-b85e-14bbcb4c74d6/83555409228.pdf
- https://uploads.strikinglycdn.com/files/4f94802f-17aa-46be-a1fc-9cbad9fe13b0/88705599568.pdf
- https://uploads.strikinglycdn.com/files/10005a1f-5909-468e-b156-7b6b89bf3074/saximomutukiwotowox.pdf
- https://uploads.strikinglycdn.com/files/46697de3-db74-4c32-a433-109cefba9d7a/92790718797.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.