Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a11ff117cfd60e6…

MALICIOUS

PDF

99.6 KB Created: 2021-03-04 15:26:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 6d13821ad33128d14a0dfa6fdd8fdf86 SHA-1: 8b3ef9ef812f3556992978a3d8c3cb3ac3500299 SHA-256: 9a11ff117cfd60e67a518ac218e1c723692581af81c524b643fa3a6ff2d7a6a8
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7330

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=is+it+wrong+to+pick+up+dungeon+light+novel+15 PDF link annotation
    • https://bisaderivulele.weebly.com/uploads/1/3/4/7/134744485/mopotab.pdfIn PDF document text
    • https://cdn.sqhk.co/zururodi/DrifIha/34851846253.pdfIn PDF document text
    • http://eslivdrug.space/jomevabalimobog7v1o.pdfIn PDF document text
    • https://luxefelukij.weebly.com/uploads/1/3/0/7/130775337/350673be259218.pdfIn PDF document text
    • http://pitushok.space/53700361759fozr6.pdfIn PDF document text
    • http://iclod.tech/the_taking_of_deborah_logan_full_movie_downloadqztsh.pdfIn PDF document text
    • http://hot-money.fun/86843954933ydg3x.pdfIn PDF document text
    • https://gaditefu.weebly.com/uploads/1/3/2/7/132712385/3cd4def4501.pdfIn PDF document text
    • https://poxatekegevu.weebly.com/uploads/1/3/4/7/134753674/ea402347b08455.pdfIn PDF document text
    • https://jarofuzaduse.weebly.com/uploads/1/3/4/5/134502270/romowivururate.pdfIn PDF document text
    • http://soldatskaya6.ru/clash_royale_private_server_apkidwgg.pdfIn PDF document text
    • https://jefamozalubibul.weebly.com/uploads/1/3/1/4/131438275/68b5079de.pdfIn PDF document text
    • https://cdn.sqhk.co/xuvisisitinu/icOjfej/3378934343.pdfIn PDF document text
    • http://carbags.site/hootsuite_digital_report_2019nbt8i.pdfIn PDF document text
    • https://cdn.sqhk.co/javomekoru/gfOOajf/nakeromerukavonojexa.pdfIn PDF document text
    • https://liziwisop.weebly.com/uploads/1/3/0/7/130776804/mipelura.pdfIn PDF document text
    • http://islemleriniz.org/what_are_the_benefits_of_using_ipads_in_schoolshodxs.pdfIn PDF document text
    • https://cdn.sqhk.co/leporolino/dPCFEcg/crazy_taxi_pc_cheats.pdfIn PDF document text
    • http://nanolenka.xyz/effective_leadership_and_management_in_nursing_8th_edition_table_of_contentsz5edl.pdfIn PDF document text
    • https://latewumopinigan.weebly.com/uploads/1/3/4/3/134313498/jedojutilovuli.pdfIn PDF document text
    • https://cdn.sqhk.co/xolafunodo/RHl6hbu/balenciaga_sneakers_women_sale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e988e791-785f-471f-b896-cf281bf1f027/buwurakixebopixi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3334486b-d2b2-425c-8231-e17f5a4e0d73/xuxizofalafogomupademezez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37be7df2-1428-4e63-915d-b3ef0be6dae3/fukib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/966ec9f8-d9a2-4b4f-a754-ae725ef3feeb/new_dance_group_name.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce7b8aa9-753a-4499-8962-68fb7985bc22/slouchy_beanie_crochet_pattern_for_beginners.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.