Malicious PDF — malware analysis report

Static analysis result for SHA-256 a29130be64e8c256…

MALICIOUS

PDF

44.8 KB Created: 2021-03-24 15:57:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 5d0c69968b3a510ca29156cf7efc472e SHA-1: 7fab9162b0cc1bd99b2ad2623b33725f99278bca SHA-256: a29130be64e8c25611a893c243ded1be7269422ea8e472fc45dbb506fc2b3f55
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7595

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=festival+off+avignon+2020+programme+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4367646/normal_6009cd21919a1.pdfIn PDF document text
    • https://cdn.sqhk.co/kumotuxijufu/ijjhdTB/tippy_tow_tippy_tay_pootie_tang.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410983/normal_604383dfc8b29.pdfIn PDF document text
    • https://cdn.sqhk.co/xusarukave/higigcR/duel_heroes_ccg_card_battle_arena_proxy.pdfIn PDF document text
    • http://rorureferujuraf.22web.org/before_i_let_go_beyonce_live_performance.pdfIn PDF document text
    • https://cdn.sqhk.co/lifudidu/jcidpjj/knives_out_cast.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384154/normal_5ff7804561f34.pdfIn PDF document text
    • https://cdn.sqhk.co/jupufopil/g4gfyKW/bajefifelalofup.pdfIn PDF document text
    • https://cdn.sqhk.co/vevodusoxif/fjgsQie/2xl_mx_offroad_data_obb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366639/normal_5fdd3b5a3a467.pdfIn PDF document text
    • https://321e46d8-a3e9-4523-905f-b0dcd1dcb7ef.filesusr.com/ugd/29fbc3_76f5e209db574628b0b5db911f46ebf6.pdf?index=trueIn PDF document text
    • http://pitowexenijodez.rf.gd/latest_version_of_whatsapp_plus_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ebd745e-85f5-4724-89db-668af17530f3/54560940300.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14be298d-3ad3-4dad-b9a3-0a7799924cf7/2046026237.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e114a396-60f8-4a97-8d42-199cca7c201a/how_to_find_cell_reference_in_excel_vba.pdfIn PDF document text
    • http://wulagaw.rf.gd/5434650324.pdfIn PDF document text
    • http://sekupudim.rf.gd/cara_belajar_photoshop_untuk_pemula.pdfIn PDF document text
    • https://55963656-6eb1-4b25-bcd5-bb835d65808b.filesusr.com/ugd/0064ae_b90b43ccdcbb425795c93c4f357dfd49.pdf?index=trueIn PDF document text
    • https://42172c5f-463d-425f-bc49-3536d5e9b788.filesusr.com/ugd/3e9aab_54861a662f3f49f9b4f528f63945b2dd.pdf?index=trueIn PDF document text
    • https://ea74ff18-003d-4094-8454-8d7e15e33abb.filesusr.com/ugd/50de67_8809a46455164a0a8b8492dc775b951f.pdf?index=trueIn PDF document text
    • https://73a1781f-5c9f-4c76-8a11-a8e8c44f336a.filesusr.com/ugd/d9f7b5_c58073d0c9b84303b99f6fa33642876e.pdf?index=trueIn PDF document text
    • https://8964868a-aef6-4da0-9a9b-29de7c28e0c5.filesusr.com/ugd/b910ae_077b8a4dc94c4535a12b10c77f9f4d84.pdf?index=trueIn PDF document text
    • https://f06ae689-34e6-4fd9-b749-a5985747e370.filesusr.com/ugd/4117a9_5a0331ab000b481fa389a99f1c2a7a34.pdf?index=trueIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.