Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab207d3595685500…

MALICIOUS

PDF

51.2 KB Created: 2020-11-24 21:35:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 1bce20f0faf54016ef53083225cf46a9 SHA-1: 63d0ff4b61a7e7bc329d2a196cc791de709af71d SHA-256: ab207d35956855002ddbd231f203c092aa0977e25eda7bcb4f21133ab417eb01
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6064

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=bootstrap+carousel+slider+responsive+template PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4366011/normal_5f89f959ce442.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472494/normal_5fb5b58888a99.pdfIn PDF document text
    • https://pevinuwipe.weebly.com/uploads/1/3/0/8/130873962/famexuz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392854/normal_5fb5caf0aa3f8.pdfIn PDF document text
    • https://denasigetul.weebly.com/uploads/1/3/4/3/134332190/1596902.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387242/normal_5f9c023bc90fd.pdfIn PDF document text
    • https://wumunelopilum.weebly.com/uploads/1/3/4/3/134395902/komorid.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385427/normal_5fad638b41bfa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56ffc345-4aba-430e-b7d1-85b6eb34897e/84796514805.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1910c82c-021d-4d43-a606-35eb36476366/paw_patrol_skye_toys.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/546c5890-421f-4754-a3b6-7e1ccc88fd7f/36207345784.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.