Malicious PDF — malware analysis report

Static analysis result for SHA-256 95b0d3cd3378229a…

MALICIOUS

PDF

39.3 KB Created: 2021-06-02 23:54:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5e01ee9446c51ce674057c7e5b108160 SHA-1: 8392c842afb147a4d25041c2ca564a7ac3ebde44 SHA-256: 95b0d3cd3378229afce22d263018a5766503462fb8d8b8bc3ed47d29e8538fc9
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by ClamAV and ML classifiers, exhibiting characteristics of a phishing lure. It contains a single image and minimal text, typical of a screenshot designed to conceal clickable links. The document embeds a large number of external PDF links, many pointing to Weebly-hosted PDFs, suggesting a link farm or redirection mechanism. The primary external URI, https://synerhu.ru/pbw?utm_term=total+war+shogun+2+cheat+engine+mac, likely serves as the initial point of contact for a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9482

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 39 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/pbw?utm_term=total+war+shogun+2+cheat+engine+mac
    • https://dovedesomubax.weebly.com/uploads/1/3/4/4/134487211/9f79c.pdf
    • https://xezelugewopisaw.weebly.com/uploads/1/3/5/3/135311865/zipafanigomofogoni.pdf
    • https://cdn-cms.f-static.net/uploads/4461751/normal_605d931d66347.pdf
    • https://cdn-cms.f-static.net/uploads/4420760/normal_602dde0e1af60.pdf
    • https://kejedavozeve.weebly.com/uploads/1/3/1/4/131483662/farepowewawebiwejazu.pdf
    • https://cdn-cms.f-static.net/uploads/4381302/normal_606d5880b9f88.pdf
    • https://cdn-cms.f-static.net/uploads/4471252/normal_5fd0bbece338e.pdf
    • https://cdn-cms.f-static.net/uploads/4386607/normal_5feaf5321e96b.pdf
    • https://lefakapuwowe.weebly.com/uploads/1/3/4/3/134353253/wosabi.pdf
    • https://cdn-cms.f-static.net/uploads/4381297/normal_601b97e5d199c.pdf
    • https://static.s123-cdn-static.com/uploads/4478933/normal_5fe3ff58beff3.pdf
    • https://static.s123-cdn-static.com/uploads/4383444/normal_5ff51d6e87007.pdf
    • https://cdn-cms.f-static.net/uploads/4464541/normal_6023ec92254ce.pdf
    • http://zopujoxobug.pbworks.com/w/file/fetch/144419379/dapaxave.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.