Malicious PDF — malware analysis report

Static analysis result for SHA-256 90d321d8431642da…

MALICIOUS

PDF

54.7 KB Created: 2021-01-19 22:09:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: c3e37a958cf7d252a9a6d435ce9e4c64 SHA-1: dfccdd23975ee67684cc610706ca124b6eb2e152 SHA-256: 90d321d8431642dad284795de6036d51211f7aa15f695d41f3f4e959da9af8be
212 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple links, including one disguised as a game download, which redirects to known malicious infrastructure. Heuristics indicate it's a malicious redirector and part of a link farm, suggesting a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of malicious intent, likely leveraging embedded JavaScript for redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6678

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/wb?keyword=free%20gun%20fire%20unknown%20survival%20battleground%20apk%20download In PDF document text
    • https://mobefoba.weebly.com/uploads/1/3/0/7/130776725/gusuladu_tijes_kuwimon_risanijiwodomi.pdfIn PDF document text
    • https://cdn.sqhk.co/jalizovi/hblbhaS/33600011607.pdfIn PDF document text
    • https://cdn.sqhk.co/xasakeza/JghLmhf/popomexe.pdfIn PDF document text
    • https://cdn.sqhk.co/libibajuzumu/hcgghbX/super_mario_emulator_iphone.pdfIn PDF document text
    • https://cdn.sqhk.co/pakebisas/hjiribF/damipekokuxew.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365628/normal_5f86f4fe347a8.pdfIn PDF document text
    • https://cdn.sqhk.co/faruvate/KjcaXgf/colony_wars_disc_2_ps1_rom.pdfIn PDF document text
    • https://cdn.sqhk.co/fapewejav/dVPBYhf/neon_yellow_running_shorts.pdfIn PDF document text
    • https://cdn.sqhk.co/fujalapevame/dVZ0hiR/livulaw.pdfIn PDF document text
    • https://cdn.sqhk.co/lusajiki/ceTyjfC/16627392228.pdfIn PDF document text
    • https://cdn.sqhk.co/berovanova/RCq1BC8/full_steam_ahead_book_summary.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465538/normal_60001a7c5626f.pdfIn PDF document text
    • https://cdn.sqhk.co/pidagasew/dDgdhac/plants_vs_zombies_heroes_free_download_for_pc.pdfIn PDF document text
    • https://weralafopibobal.weebly.com/uploads/1/3/4/3/134338927/1854554.pdfIn PDF document text
    • https://ferofetilusef.weebly.com/uploads/1/3/5/3/135346026/ruvajimonan.pdfIn PDF document text
    • https://cdn.sqhk.co/daxozazon/4LjbSig/45487971298.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.