PDF malware analysis — malicious · 93fae79ab6cfe852

MALICIOUS

PDF

59.8 KB Created: 2021-04-24 19:51:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4602bf852aff2197119cc8fb97e80202 SHA-1: e09606fe0040d4139146b1c67e1a8dae016f5a31 SHA-256: 93fae79ab6cfe852282a144823195c2a1c3918394bb03fed7f9b8d3457e14b83

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and ML classifiers, and exhibits characteristics of a phishing lure. The heuristic 'PDF_IMAGE_LURE' indicates it's an image-only document designed to trick users into clicking an embedded URI. The primary external URI, https://maypoin.ru/strik?utm_term=white+christmas+tree+with+blue+lights+ideas, is likely the malicious destination. The presence of a large number of external links suggests a link farm intended to distribute malicious content or engage in SEO poisoning.

Machine Learning

Nyx PDF Classifier malicious score 0.5493

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 59 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://maypoin.ru/strik?utm_term=white+christmas+tree+with+blue+lights+ideas
- https://cdn-cms.f-static.net/uploads/4419851/normal_6059b82deeb99.pdf
- https://cdn.sqhk.co/vorebilifi/eidSdaG/polar_explorer_roller_coaster.pdf
- http://xemopubuga.iblogger.org/mendelian_genetics_worksheet_1_answers.pdf
- https://cdn.sqhk.co/libobivole/ejfidih/the_game_of_life_online_cellular_automata.pdf
- http://lexamopelezun.mywebcommunity.org/77742007449.pdf
- https://cdn-cms.f-static.net/uploads/4367674/normal_602042e8392e8.pdf
- https://static.s123-cdn-static.com/uploads/4491946/normal_5fcd55d354a32.pdf
- https://cdn.sqhk.co/sunomedude/bPycPYJ/block_puzzle_new_1010_king.pdf
- https://cdn.sqhk.co/kapapomabu/iqidijv/delusions_and_other_irrational_beliefs.pdf
- https://cdn.sqhk.co/wakewafo/gdjfgcX/fosexinogisusilisuri.pdf
- https://cdn-cms.f-static.net/uploads/4379736/normal_602970055f212.pdf
- https://cdn.sqhk.co/letarezetap/CvgiczF/ragaduwojak.pdf
- http://vesajob.getenjoyment.net/pafitew.pdf
- https://cdn.sqhk.co/poxirowo/gigfgd1/shooter_jennings_kids.pdf
- https://cdn.sqhk.co/bolukawet/bijoEC9/toon_blast_hack_android_2019.pdf
- http://vudujupuboneg.22web.org/jirer.pdf
- http://vejojivusuze.rf.gd/arqueologia_del_saber.pdf
- http://divapikej.rf.gd/john_deere_310_backhoe_hydraulic_problems.pdf
- http://kuxemozoxabonag.onlinewebshop.net/zidaxegirawuwinisaxa.pdf
- https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_c842720fa780430eb1c33371d9ae9385.pdf?index=true
- https://b23ebcb4-2e41-4c68-a408-584c84124782.filesusr.com/ugd/5a2446_b8e22f84d7644ca8b71910ee3ee33d1c.pdf?index=true
- https://ce722411-b424-48ee-ac00-b4ed8818edd9.filesusr.com/ugd/bff0de_68a26939211a4388801c993b8852a8ae.pdf?index=true
- http://defozuwonig.rf.gd/living_by_the_book_workbook_answers.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.