Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae71cce6b13d52b7…

MALICIOUS

PDF

54.6 KB Created: 2021-02-15 06:46:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1d7055fb500df049afcaa1046b732fad SHA-1: 1a99c13cf7cc3d306558fc30225f047dede94fc8 SHA-256: ae71cce6b13d52b72454db6273fbac44d033ed4e53ec939429e4e640c04899ab
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, a common tactic for link farms or phishing campaigns. Heuristics indicate a 'PDF_SEO_LINK_FARM' and 'ML_NYX_PDF_MALICIOUS', along with ClamAV detecting it as 'Pdf.Phishing.Trojan'. The embedded URL 'https://jottigo.ru/aws?utm_term=ssms+format+sql+add+in' suggests a lure related to SQL formatting tools, likely to trick users into visiting a malicious site. No scripts were extracted, but the overall structure and heuristics point to a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7499

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/aws?utm_term=ssms+format+sql+add+in
    • http://sberbank.link/60816122187d0tjf.pdf
    • https://static.s123-cdn-static.com/uploads/4368506/normal_5ffc7f45ceb3e.pdf
    • https://cdn-cms.f-static.net/uploads/4382631/normal_5fd26fc137d22.pdf
    • https://faxezufag.weebly.com/uploads/1/3/0/8/130874059/8921382.pdf
    • https://funavekun.weebly.com/uploads/1/3/0/9/130969801/af8434fe4d699.pdf
    • https://static.s123-cdn-static.com/uploads/4489717/normal_600503098e8d5.pdf
    • http://yewes.space/fakegisewasivukobikanogs8j7.pdf
    • http://24goodstore.site/wobaloxadejere6imv.pdf
    • https://sesemuxedewa.weebly.com/uploads/1/3/4/0/134017121/c399247.pdf
    • https://s3.amazonaws.com/damerirazib/boney_m_christmas_songs_lyrics_free.pdf
    • https://s3.amazonaws.com/gozifep/clasificacion_de_empresa_segun_forma_juridica.pdf
    • https://s3.amazonaws.com/mesotodimus/xonapugu.pdf
    • https://s3.amazonaws.com/kigavanus/bharathiar_university_mba_syllabus_2017.pdf
    • https://s3.amazonaws.com/muwemivumazulax/aisi_laagi_lagan_song_javed_ali.pdf
    • https://s3.amazonaws.com/sojebelevenex/comparisons_exercises_intermediate.pdf
    • https://s3.amazonaws.com/zoromexemuzid/pisarofawap.pdf
    • https://s3.amazonaws.com/tinivukedeta/sample_investigation_report_employee_theft.pdf
    • https://s3.amazonaws.com/nuxulikiwab/55909878360.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.