PDF malware analysis — malicious · 8a733acb1694fef7

MALICIOUS

PDF

58.6 KB Created: 2021-04-10 22:06:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17

MD5: 0365ea758da194479ff83baac16d57e4 SHA-1: 7586705b476ce3a74397a22f8d3c985c30e40f99 SHA-256: 8a733acb1694fef7fb0e8f206e0e377d4317eff03079db110dc697b525110d95

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The presence of numerous embedded links, many pointing to unknown or potentially suspicious domains, suggests a link farm or phishing lure. The document body, though heavily obfuscated, contains metadata indicating it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

Nyx PDF Classifier malicious score 0.9900

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.termis.org/system/files/webform/nibobuzokojovafizuza.pdf In PDF document text
- https://www.osgeurope.com/sites/osg-corporate.dev/files/webform/kanuvanirarotugawabu.pdfIn PDF document text
- https://ambrose.edu/sites/default/files/webform/26147793628.pdfIn PDF document text
- https://www.blplegal.com/sites/default/files/webform/54305505708.pdfIn PDF document text
- https://www.jsif.org/sites/default/files/webform/95147346690.pdfIn PDF document text
- https://www.termis.org/system/files/webform/88699151804.pdfIn PDF document text
- http://www.guninetwork.org/system/files/webform/heirri_proposals/rarapenebeku.pdfIn PDF document text
- https://www.mothercare.ro/sites/default/files/webform/resumes/28941778760.pdfIn PDF document text
- https://natsihwa.org.au/sites/default/files/webform/46250275999.pdfIn PDF document text
- http://pilgrimland.com/sites/default/files/webform/resume-uploads/40494538869.pdfIn PDF document text
- http://www.pacificsportfraservalley.com/sites/default/files/webform/pulipalukegibivep.pdfIn PDF document text
- https://www.visitsavannah.com/sites/default/files/webform/mubojezelu.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/DOqCt-cVA4I/uplcv?utm_term=somme+des+angles+d+un+quadrilat%25C3%25A8rePDF link annotation
- https://campusrec.princeton.edu/system/files/webform/putiwokareviwe.pdfIn PDF document text
- https://campusrec.princeton.edu/system/files/webform/luzatebinibaxopititum.pdfIn PDF document text
- https://www.ice.cam.ac.uk/sites/www.ice.cam.ac.uk/files/webform/68876097481.pdfIn PDF document text
- https://thesanfordschool.asu.edu/sites/default/files/webform/moxogugudufagelo.pdfIn PDF document text
- https://printandmail.princeton.edu/system/files/webform/83401752781.pdfIn PDF document text
- https://www.healthdata.org/sites/default/files/resumes/58023923203.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.