Malicious PDF — malware analysis report

Static analysis result for SHA-256 a110da01b7dc4d89…

MALICIOUS

PDF

65.6 KB Created: 2021-03-16 22:44:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: b236553fe4527be222fda8cc254424ce SHA-1: 824729d2e6c30580119b0fde52b417a7d6a4fe19 SHA-256: a110da01b7dc4d89257bf9050fa8f9f0eb9fc92bacadbf9f62721ebb40be1d3b
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6087

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=igloo+mini+fridge+not+getting+cold PDF link annotation
    • http://fozivot.mypressonline.com/69525325235.pdfIn PDF document text
    • http://belixawotid.66ghz.com/accident_reports_nj_turnpike_today.pdfIn PDF document text
    • http://gogemupiru.22web.org/voguvu.pdfIn PDF document text
    • http://laribij.scienceontheweb.net/meaning_of_national_development.pdfIn PDF document text
    • http://danoguvu.medianewsonline.com/muzatole.pdfIn PDF document text
    • http://nopawumakonip.22web.org/male_genitourinary_exam_template.pdfIn PDF document text
    • http://zugapuvu.mywebcommunity.org/pfms_bank_list.pdfIn PDF document text
    • http://motarojetox.sportsontheweb.net/83878131943.pdfIn PDF document text
    • http://tejovotemikodes.getenjoyment.net/panasonic_viera_television.pdfIn PDF document text
    • http://letilemugemin.66ghz.com/waiting_for_godot_book_free.pdfIn PDF document text
    • http://sadugumipid.iblogger.org/lipizite.pdfIn PDF document text
    • http://zurojudu.22web.org/veritivitobutixusepumum.pdfIn PDF document text
    • http://rakajizure.rf.gd/master_of_orion_2_races.pdfIn PDF document text
    • http://tezipibuboxigo.epizy.com/applied_mathematics_2_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e4a2cc0-18eb-4769-bca5-9291a584271a/24807453229.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f61cb740-2bea-49c3-95bb-07f86d39dcb7/19614281582.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d73c3be7-bee3-4d29-bfa8-ec74ae543525/how_to_pair_voyager_5200.pdfIn PDF document text
    • http://mekamaxabojumoz.epizy.com/aerobic_exercise_for_beginners_video_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d5cb5c9-1f84-4ee0-9d10-fc71d6092c02/helter_skelter_book_amazon.pdfIn PDF document text
    • http://fudotebu.epizy.com/16915839263.pdfIn PDF document text
    • http://tetexamafikej.epizy.com/59317321942.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c64cbe6-3562-43af-83a1-7b65069a6c89/12575746142.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.