PDF malware analysis — malicious · 83bd0be2b9724b75

MALICIOUS

PDF

50.3 KB Created: 2021-04-04 21:59:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 85d6d3707e0e69f235010c429d68d727 SHA-1: d0570e9a701a70af530716a4c9072010e5d274ea SHA-256: 83bd0be2b9724b7596db3dfdafc4c6187e5b41d4c513d9bb6adf6c964dd9cc20

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as a malicious phishing document by ClamAV and ML classifiers. It employs a common screenshot lure technique, typical of phishing campaigns, to entice users to click on embedded links. The document contains a large number of external links, many of which point to potentially malicious PDF files hosted on file-sharing services.

Machine Learning

Nyx PDF Classifier malicious score 0.8343

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/award?keyword=the+sewing+book+by+alison+smith+pdf
- https://jomufoxubibad.weebly.com/uploads/1/3/1/1/131164047/sigaruro.pdf
- https://nenubijul.weebly.com/uploads/1/3/5/3/135393623/401f2f7fa20.pdf
- https://faxusonugavipil.weebly.com/uploads/1/3/4/7/134741565/vakaxeso.pdf
- http://rineset.xyz/fix_auto_rotate_on_androidho4b0.pdf
- https://cdn.sqhk.co/fimirexuf/dnoN1jh/video_player_vlc_download.pdf
- http://carinsusa.info/spectrum_math_workbook_grade_8_free92cvz.pdf
- https://xitarowax.weebly.com/uploads/1/3/2/6/132681505/17a7e4a59a3.pdf
- http://anarchymedya.com/3220661402911gn1.pdf
- https://cdn.sqhk.co/lawikuto/Lhh9s8X/makogajulavuvatokozi.pdf
- https://mitewowepo.weebly.com/uploads/1/3/0/8/130813710/wojegamolofet.pdf
- http://lnstagram-copyright-supports.com/16087095109potm4.pdf
- http://frut-tree.site/brookstone_wireless_headphones_pairingqi1wh.pdf
- https://s3.amazonaws.com/zuvovoxigumuz/tabla_de_aniones_y_cationes_completa.pdf
- https://s3.amazonaws.com/dobikasukavu/guidestone_financial_login.pdf
- https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_a5b5b00bb33f40ea9de5632ea5be14c6.pdf?index=true
- https://09ec9d85-9312-4337-94d0-b84080e05f2e.filesusr.com/ugd/ac0094_780000db038c415db2391f73b1b7addb.pdf?index=true
- https://4a39c6c9-989b-4d11-b2d8-cc0becc7f193.filesusr.com/ugd/ef0078_01f05830abf946b88f5e9b46fa677c45.pdf?index=true
- https://5a060084-92f5-4e09-b02e-bbac8bb45871.filesusr.com/ugd/05c943_af19035658164306b8857e9a260dbe4e.pdf?index=true
- https://s3.amazonaws.com/wenobagupexekap/84388694206.pdf
- https://cc652f91-b1ab-470c-b36f-46d838ef85b2.filesusr.com/ugd/fbccce_a10f32ae00a2462e9e932974a7fab632.pdf?index=true
- https://8f1ef4f7-3f23-41ef-a3d6-4e5873a175a2.filesusr.com/ugd/d318ce_fa3a209e27f8447595e56afd47aff5a2.pdf?index=true
- https://s3.amazonaws.com/joterige/installation_of_cost_accounting_system.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.