Malicious PDF — malware analysis report

Static analysis result for SHA-256 aad4525e336ec085…

MALICIOUS

PDF

66.8 KB Created: 2021-03-13 23:30:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8cb88b39d676e10bd12f6066c251a5bc SHA-1: 8edf406f5de68dcce30a1fd276e1372bc9a4273a SHA-256: aad4525e336ec08556d6ff355029d8f9a292ae7a45a1e7662ddd85ed9eb8228d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, many of which are part of a link farm designed to manipulate search engine results. The primary URL, 'https://baarspo.ru/award?keyword=malaria+treatment+guidelines+2020+pdf', suggests a lure related to medical information, likely for phishing or scam purposes. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9558

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=malaria+treatment+guidelines+2020+pdf
    • https://wenezobu.weebly.com/uploads/1/3/4/6/134625155/wolasofanuze_nuluwib_lamomoxaxidu_tilawi.pdf
    • https://resewirebibabap.weebly.com/uploads/1/3/1/3/131379054/roromajuzexexev-kunixekesuma-funorib-motuveduxax.pdf
    • http://dejijesumewir.22web.org/what_is_the_story_of_the_maze_runner_series.pdf
    • https://sivipafegedijog.weebly.com/uploads/1/3/4/4/134443607/3333534.pdf
    • http://missunik.space/directv_4k_genie_mini_clientr6y6w.pdf
    • https://bogadisosupotaj.weebly.com/uploads/1/3/0/7/130776541/5c0e2e.pdf
    • https://dijitisabotiji.weebly.com/uploads/1/3/5/3/135324222/5069356.pdf
    • http://artyom.guru/5_examples_of_simile8obwz.pdf
    • https://s3.amazonaws.com/dinilederu/bavotazebibalalidabesun.pdf
    • http://robogotut.epizy.com/casing_capping_wiring_accessories.pdf
    • https://s3.amazonaws.com/fikuvine/visual_studio_for_mac_android_device_manager.pdf
    • https://d25e5d79-f3dc-43ab-8538-58f2f4730235.filesusr.com/ugd/898300_f158855956534b7d89f2094ec91de225.pdf?index=true
    • https://s3.amazonaws.com/fajeloninesitel/assamese_dictionary_apk.pdf
    • https://s3.amazonaws.com/kegubinefuda/auditoria_informatica_enrique_hernandez.pdf
    • https://a95edb9d-21e5-46e4-bb1b-b1fdf66a5dae.filesusr.com/ugd/09e34a_13ed22130eec4f72999bf8fe686f723a.pdf?index=true
    • https://s3.amazonaws.com/jalasilunaz/tedelotobi.pdf
    • https://s3.amazonaws.com/fezenur/uppababy_2020_vista_v2_stroller_-_sierra_dune_knit_silver_black_leather.pdf
    • https://s3.amazonaws.com/bulolimepol/2813098954.pdf
    • https://s3.amazonaws.com/nevowimo/stihl_ts400_spark_plug_boot.pdf
    • http://lisokabosexipep.epizy.com/dazakize.pdf
    • https://s3.amazonaws.com/dazinibonofobi/wow_classic_warlock_demons_guide.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.