Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad3ca8e02af175bc…

MALICIOUS

PDF

46.2 KB Created: 2021-03-29 14:27:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: 3dbe87668ae3efb38bb6bfa1a87d69fa SHA-1: 3839524b8583eb85fe3e20c4818e043a37329ace SHA-256: ad3ca8e02af175bce30a35e0e795e4bfd7d8b775f079b9842d6c3a1d9a5bc461
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document flagged by multiple heuristics as malicious, including a ML classifier and ClamAV. It contains numerous embedded URLs, with at least one, 'https://maypoin.ru/award?keyword=agriculture+biologique+%25C3%25A0+madagascar+pdf', identified as a potential phishing or malware distribution point. The PDF structure and embedded links suggest it's designed to trick users into visiting external, potentially harmful, websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7903

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=agriculture+biologique+%25C3%25A0+madagascar+pdf PDF link annotation
    • http://juzufafezena.22web.org/covid_health_policy.pdfIn PDF document text
    • http://somixewavado.sportsontheweb.net/73157725335.pdfIn PDF document text
    • http://bokadexediwax.22web.org/12129041041.pdfIn PDF document text
    • https://cdn.sqhk.co/tomubozes/dhdkdhc/11981195048.pdfIn PDF document text
    • http://nigavereke.mygamesonline.org/zuparidosoxi.pdfIn PDF document text
    • https://cdn.sqhk.co/repejuvovod/jbjghic/biharmasti_in_chhath_2019.pdfIn PDF document text
    • http://kurametugugu.mygamesonline.org/96247983309.pdfIn PDF document text
    • http://tanubujurutemut.scienceontheweb.net/ayurvedic_plants_information_in_english.pdfIn PDF document text
    • https://cdn.sqhk.co/bawusipa/Phjgdji/42975069329.pdfIn PDF document text
    • http://voferumupisefag.rf.gd/american_english_file_2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd00baaf-ca3c-4d1d-a59d-74e4ce60cade/83712598621.pdfIn PDF document text
    • https://s3.amazonaws.com/mexijegedakol/16363088300.pdfIn PDF document text
    • http://tavamikilav.myartsonline.com/94006074450.pdfIn PDF document text
    • http://xixujoteb.epizy.com/15327863954.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bf910df-00d5-4e04-91f2-4add5e499a80/does_sharp_make_all_microwave_drawers.pdfIn PDF document text
    • http://japotegalavig.epizy.com/70796276596.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6898ce17-dcd0-4deb-abde-28b73a2b4a14/47667565890.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3c099c1-59f9-495e-a86f-ccc4494040b6/reflective_essay_examples_high_school_students.pdfIn PDF document text
    • http://tirujukixiw.epizy.com/46170546798.pdfIn PDF document text
    • http://nazozogev.epizy.com/aftermaster_pro_user_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/wapabefizosumi/podonuruxer.pdfIn PDF document text
    • https://s3.amazonaws.com/vofadoloves/6000167072.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.