Malicious PDF — malware analysis report

Static analysis result for SHA-256 8984cfe471fb2cbb…

MALICIOUS

PDF

40.8 KB Created: 2021-04-02 11:41:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3a7d05537a5bba36c87a79fe72468a84 SHA-1: 5b6da369e355b18f2c5c21881d414e664f979d90 SHA-256: 8984cfe471fb2cbb14a98a56b34e59bfed13e73e567bdbe2a1e3188ac3a6a91c
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-only nature and embedded clickable link. The heuristic 'PDF_IMAGE_LURE' indicates a common tactic where a screenshot is used to hide an action trigger. The presence of numerous external URLs, including a link farm, suggests an attempt to redirect users to malicious content or phishing pages. The ClamAV detection further supports its malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8221

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 40 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=five+characteristics+of+an+entrepreneur+pdf
    • https://saxonolofazejel.weebly.com/uploads/1/3/2/6/132681209/0606555d82.pdf
    • https://cdn.sqhk.co/fowipovoji/jcfib8x/easy_sour_cream_lemon_pound_cake_recipe.pdf
    • https://cdn.sqhk.co/bajipugotox/b2iiLOj/40056346649.pdf
    • https://xarugowa.weebly.com/uploads/1/3/4/7/134733051/7225a68d0981b3.pdf
    • http://topukovatawosu.sportsontheweb.net/39958996939.pdf
    • http://zukirudon.mypressonline.com/calendario_liga_portuguesa_2020.pdf
    • http://lusuwivaw.medianewsonline.com/pujexamomexipene.pdf
    • https://cdn.sqhk.co/mulepava/hihiifc/music_mp3_songs_download_telugu.pdf
    • https://cdn.sqhk.co/lajakukilo/cxghshj/wiki_for_cod_warzone_modern_warfare.pdf
    • http://xevojifixifepi.scienceontheweb.net/benim_hocam_tarih_2020.pdf
    • https://cdn.sqhk.co/medujebukoma/0yy3fif/best_template_for_cv.pdf
    • https://palavelo.weebly.com/uploads/1/3/4/8/134891967/lewirikupi.pdf
    • https://cdn.sqhk.co/jebumujo/fjchdhb/1426279670.pdf
    • https://sekorora.weebly.com/uploads/1/3/4/8/134856449/53dced48fb88.pdf
    • https://vixevugipun.weebly.com/uploads/1/3/5/3/135327752/faxepigig.pdf
    • https://cdn.sqhk.co/sovebiba/hhuTgeh/advertising_agency_success_stories.pdf
    • http://nolumuj.epizy.com/clio_2019_legal_trends_report.pdf
    • http://piwakitidi.onlinewebshop.net/12728451501.pdf
    • http://lepetape.epizy.com/ccm_care_plan_template.pdf
    • http://forezepolutaju.onlinewebshop.net/fogukavizenopagusenavi.pdf
    • http://fugewad.rf.gd/nokia_android_phones_list_in_pakistan.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.