Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f7755ebfd8a6d21…

MALICIOUS

PDF

54.6 KB Created: 2021-04-01 01:14:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 63ab4a86c42298cef59379550c9044bb SHA-1: 8cb3d1d247c49d538c1661792168bc70e13530cc SHA-256: 9f7755ebfd8a6d21d42528bad26b8d79732ab88f6fdf6af0ad02541b5318281a
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6222

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/aws?utm_term=perimeter+area+and+volume+worksheets+pdf+grade+6 PDF link annotation
    • http://zajapokel.22web.org/32733750357.pdfIn PDF document text
    • https://cdn.sqhk.co/pigajifaw/Yighfjj/sofizujuxizipu.pdfIn PDF document text
    • http://bigakeka.iblogger.org/11824306199.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486221/normal_60365ce36f4dd.pdfIn PDF document text
    • https://cdn.sqhk.co/lidojuxuxiro/aiaiaI4/agl_energy_annual_report_2015.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4505771/normal_6000d37fc621c.pdfIn PDF document text
    • http://zopaxonurur.iblogger.org/66940095866.pdfIn PDF document text
    • http://marabape.iblogger.org/blasphemy_against_the_holy_spirit.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481157/normal_5fd7001bc9b8e.pdfIn PDF document text
    • https://cdn.sqhk.co/xabiximakef/haifEih/tixominazi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472186/normal_604d8bbba5f66.pdfIn PDF document text
    • http://lopavatizurafe.iblogger.org/60618196112.pdfIn PDF document text
    • https://cdn.sqhk.co/nobutowug/cajhxIR/artificial_intelligence_a_modern_approach_third_edition_solutions.pdfIn PDF document text
    • https://cdn.sqhk.co/tuwagezo/duiejfB/lokadu.pdfIn PDF document text
    • http://mavurelaro.22web.org/60570923953.pdfIn PDF document text
    • https://s3.amazonaws.com/toguvaju/cuentos_chinos_andres_oppenheimer.pdfIn PDF document text
    • https://s3.amazonaws.com/fowonaxul/78259232092.pdfIn PDF document text
    • http://lexizilasajeso.rf.gd/badminton_world_federation.pdfIn PDF document text
    • http://tureverikatefe.epizy.com/jenis_bronkodilator.pdfIn PDF document text
    • http://kuwexugebukutim.rf.gd/33314995946.pdfIn PDF document text
    • https://s3.amazonaws.com/tafogusegabomu/28943405754.pdfIn PDF document text
    • https://s3.amazonaws.com/dadupawo/duwotolepazag.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.