Malicious PDF — malware analysis report

Static analysis result for SHA-256 97736eefe69e13b5…

MALICIOUS

PDF

42.4 KB Created: 2021-04-01 23:34:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 89d12ac89c8320be0331eb18ac5c12b0 SHA-1: 3c94c00f55a04f2ddada62346f172c0a61c3c56a SHA-256: 97736eefe69e13b5db683f34e5c230409437f9f70810e04ae26c6b2b7c3306e1
204 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as a phishing lure due to its image-only nature and embedded clickable links. The heuristics indicate it contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to distribute malicious content or redirect to phishing sites. The ClamAV detection and ML classifier further support its malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7383

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 42 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/aws?utm_term=american+politics+today+6th+edition+ebook
    • http://dasuwupozu.22web.org/fatebikopowutazegik.pdf
    • https://daxuvinu.weebly.com/uploads/1/3/2/6/132695190/juvoba.pdf
    • https://zavowije.weebly.com/uploads/1/3/2/6/132680855/merokonebojujowanere.pdf
    • https://sezebotari.weebly.com/uploads/1/3/1/6/131636698/givexar.pdf
    • https://kaxagigunuji.weebly.com/uploads/1/3/1/3/131383746/gemuwowipomuvawibi.pdf
    • http://kosodidaxelo.22web.org/expository_essay_examples_for_middle_school.pdf
    • https://fadefewili.weebly.com/uploads/1/3/4/3/134316521/vumiwifatuxosi.pdf
    • https://static.s123-cdn-static.com/uploads/4366350/normal_5ff7ab74a9b60.pdf
    • http://zufabud.22web.org/biogas_plant_working.pdf
    • https://static.s123-cdn-static.com/uploads/4393483/normal_5fc8b4ab2f79d.pdf
    • https://vonasadan.weebly.com/uploads/1/3/3/9/133986887/9899680.pdf
    • https://vesokawewewavi.weebly.com/uploads/1/3/1/3/131382886/eac7b2038fef20.pdf
    • https://cdn-cms.f-static.net/uploads/4393626/normal_605abba5b2763.pdf
    • https://bamegipizof.weebly.com/uploads/1/3/4/6/134647446/vigevopobul.pdf
    • https://mefupawex.weebly.com/uploads/1/3/4/3/134317460/8222955.pdf
    • https://cdn-cms.f-static.net/uploads/4374535/normal_601c6398ba9dc.pdf
    • https://cdn-cms.f-static.net/uploads/4493888/normal_60199df663e57.pdf
    • https://uploads.strikinglycdn.com/files/2b6454c5-db99-4b3e-85cf-65bff17fb0eb/vakizalizu.pdf
    • https://f3215690-35ba-4bce-915f-db1a6f912a1b.filesusr.com/ugd/d32599_903e733b88ae44cd9df65243dd17e31a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d0ed9af9-d506-43a7-90a5-6fa085283c66/how_to_get_general_power_of_attorney_in_florida.pdf
    • https://2b912d1d-4511-4d15-ad79-79d4d77caf35.filesusr.com/ugd/738632_7131be04d928489ab635521831179b4d.pdf?index=true
    • http://kapugekemasili.rf.gd/64897174120.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.