PDF malware analysis — malicious · 833a1176634274a5

MALICIOUS

PDF

64.0 KB Created: 2021-03-22 20:06:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 24f2b5481d9d31be09175f2ab4fedca4 SHA-1: b46eab39a63f7cfdea68c4692e595e96c6632137 SHA-256: 833a1176634274a5a0b710ddf61bf571aafeba7f866235ecd0d604614358d6df

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains a heuristic firing for a link farm, directing users to a URL that mimics a search result for a specific document. This URL, 'https://gimoguvi.ru/award?keyword=supply+chain+management+sunil+chopra+pdf+download', is likely intended to trick users into downloading malicious content. ClamAV also detected the file as 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0', further indicating malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.5377

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gimoguvi.ru/award?keyword=supply+chain+management+sunil+chopra+pdf+download
- https://uploads.strikinglycdn.com/files/ad62f2db-cc17-473e-8bc1-640663c5081b/dulawegomurajapunatuboz.pdf
- https://uploads.strikinglycdn.com/files/3d060268-1809-4d76-a0b4-e659c987b628/47066244555.pdf
- https://uploads.strikinglycdn.com/files/37347c2c-ab0e-4854-a028-9f36e7eac576/how_to_reset_nook_hd.pdf
- http://gevewodex.epizy.com/samowateti.pdf
- https://uploads.strikinglycdn.com/files/cfeca430-a540-46f3-a82a-caae2c89a62d/what_shows_are_on_us_netflix_not_in_australia.pdf
- https://989244f3-426d-4557-b4f1-0018dac9047c.filesusr.com/ugd/57c819_0dd2707265964b258cd8b5e59ec63622.pdf?index=true
- https://uploads.strikinglycdn.com/files/503366de-c575-4435-bc3a-e318b92e6874/how_to_use_a_bosch_laser_level.pdf
- http://xutarefes.epizy.com/simugo.pdf
- https://275320ff-96dd-455a-9699-a0fdc58b27a5.filesusr.com/ugd/943725_3fb20b6bc4f240fdb26d8fca8165139f.pdf?index=true
- https://73f4d879-981c-49fe-abc7-520f36a14a84.filesusr.com/ugd/b77b08_b30497e5e0374807ae819c7bbb873983.pdf?index=true
- https://s3.amazonaws.com/fewunadupop/24872045513.pdf
- https://s3.amazonaws.com/sosupejuxofedo/5425924883.pdf
- https://7d6e376e-1ee3-4df5-88c1-8d1511d419f8.filesusr.com/ugd/7dd30d_fadf3aef6e95489e8546da14d824b951.pdf?index=true
- https://s3.amazonaws.com/lorugipopuxe/mopufidonevuvunidemixete.pdf
- https://88966db1-4a83-4446-b941-f65022a6235f.filesusr.com/ugd/928e0f_f0313ed61ed840a4ab86c50791d75ccb.pdf?index=true
- https://45f91bdd-2b68-4e60-ae2c-b14373ae5332.filesusr.com/ugd/0d089b_bd2104aab6fe47f1a0289a203a175722.pdf?index=true
- https://95c758d6-fd33-43c6-b5d0-f1f55e07e946.filesusr.com/ugd/cb0188_b0226c117ca04f81babed38382d188a2.pdf?index=true
- https://a86b13d2-a9ad-4039-ad74-10d2f7332aba.filesusr.com/ugd/6e2451_dd9c93ce8ff548f1842f14b2fe3ced90.pdf?index=true
- https://s3.amazonaws.com/pobixedele/xiwezekajufi.pdf
- https://855e1e5b-0daf-4dce-aa73-dfad2bfec5df.filesusr.com/ugd/ced2dc_db35cb34e7224022b4cf476e13ddf343.pdf?index=true
- http://bepofitome.rf.gd/zidumumomudax.pdf
- https://s3.amazonaws.com/garorowa/braeburn_thermostat_manual_2990-_01.pdf
- https://s3.amazonaws.com/vofadoloves/jasujaron.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.