Malicious PDF — malware analysis report

Static analysis result for SHA-256 853cb8a8dda3585a…

MALICIOUS

PDF

39.3 KB Created: 2021-03-11 19:35:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: ee25559f831e9cd9ddf5a30ec0ee97e4 SHA-1: dd4e8971bb90820de023d3210e18443f93538f83 SHA-256: 853cb8a8dda3585a9a4cb40c18f5bd3a477d4f8818076a371f4848d59d300f63
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-only nature and embedded clickable link. It contains numerous external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to malicious content. The ClamAV detection and ML classifier further support its malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7882

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 39 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=body+dysmorphic+disorder+treatment+manual+pdf PDF link annotation
    • https://zukutalemuz.weebly.com/uploads/1/3/4/5/134582669/daxoperok.pdfIn PDF document text
    • https://cdn.sqhk.co/delotijuw/Uihilic/23375510340.pdfIn PDF document text
    • http://studytogether.fun/lennie_kills_curleys_wife_chaptergqfz3.pdfIn PDF document text
    • https://kinigapiluxuke.weebly.com/uploads/1/3/4/8/134863840/8634ab9aa626ac5.pdfIn PDF document text
    • http://nutosuvitiraj.scienceontheweb.net/diccionario_italiano_espanol_en_linea_gratis.pdfIn PDF document text
    • http://lovelid.xyz/laser_quest_prices_mississaugab540z.pdfIn PDF document text
    • https://cdn.sqhk.co/duvapegoleva/hidVgij/fomel.pdfIn PDF document text
    • https://cdn.sqhk.co/wofazexej/iaHhghi/duck_hunter_costume_for_dogs.pdfIn PDF document text
    • http://zodimasar.mypressonline.com/22030509642.pdfIn PDF document text
    • https://cdn.sqhk.co/kopupelek/Kicjhhg/xewamupugudil.pdfIn PDF document text
    • https://cdn.sqhk.co/mikitikotak/jjUFhG7/56091811412.pdfIn PDF document text
    • https://wukelefitifaka.weebly.com/uploads/1/3/4/8/134882985/madafuwa_bulefi_wokedamel.pdfIn PDF document text
    • http://topdiscount.pro/pain_in_the_heel_of_my_footj9lgt.pdfIn PDF document text
    • https://kinigapiluxuke.weeblyIn macro / runtime command snippet
    • https://uploads.strikinglycdn.com/files/0938e45c-74ac-4a5a-8da5-324a2c6d4759/baby_einstein_activity_jumper_symphony.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74273023-1440-43c9-b41d-6881aa007eb6/handwriting_analysis_forensics_activities.pdfIn PDF document text
    • https://550dfcec-0280-4316-a0d5-68b74a7a20b9.filesusr.com/ugd/f59309_f692ec7459004df3b6aed2cdb70e3e37.pdf?index=trueIn PDF document text
    • https://7915398d-c9c2-4241-abdb-40cf742e4b8d.filesusr.com/ugd/d4df0f_38fb39adc8c74dff822addf460b80308.pdf?index=trueIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.