Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6bb322affbddc6f…

MALICIOUS

PDF

50.6 KB Created: 2021-04-06 12:20:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dbc7cf26779de1c3f6e70306f51ad0eb SHA-1: a012f81b18251d91ff65e6a3f3441ade4cb7a89d SHA-256: b6bb322affbddc6f2061b7998d0d6d301a1d862d2a8e89c9d97e36e758efd571
204 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by multiple heuristics and a machine learning classifier, indicating a phishing attempt. It functions as an image-only lure, presenting a screenshot to entice users to click on embedded URLs. The document contains a large number of external links, many hosted on disposable domains, suggesting it's part of a link farm designed to distribute malicious content or redirect users to phishing sites. No scripts were extracted, but the presence of embedded URLs points to a potential redirection to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6386

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/aws?utm_term=who+to+call+to+repair+washing+machine
    • https://ruputosara.weebly.com/uploads/1/3/4/4/134456906/bisudiwap_tilesevitavus_sumagomojaruxon.pdf
    • http://shopsmmv.site/how_to_find_guided_access_on_ipad3u8jo.pdf
    • http://1xbet-football.fun/how_to_use_the_uppababy_bassinet_for_overnight_sleeping64ghd.pdf
    • http://solent.bar/u_n_d_p_ki_full_form0qkvz.pdf
    • https://jabifuvos.weebly.com/uploads/1/3/1/0/131070291/f9edacded.pdf
    • http://wafavipejolap.22web.org/curso_de_primeros_auxilios_gratis_cruz_roja_bogota.pdf
    • http://jikonuja.22web.org/xokeferezagigekuzogu.pdf
    • https://zodukoweferu.weebly.com/uploads/1/3/1/0/131069906/ab3a36a596.pdf
    • http://health-top.ru/wings_of_fire_movie_release_date_2020xuh84.pdf
    • http://prostosite.site/chamberlain_universal_keypad_dip_switch_programmingbqo59.pdf
    • https://doxujivadew.weebly.com/uploads/1/3/4/8/134875716/650553.pdf
    • https://nolutoxut.weebly.com/uploads/1/3/4/6/134683805/rokona.pdf
    • https://50b44c92-959e-4a15-bf83-93d6b2b518d6.filesusr.com/ugd/3ed44c_4ab1225952b343ca899c7432eef18e3b.pdf?index=true
    • https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_bde211b0bce549c8906a015853fd68b9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3978544a-098a-4be4-9f00-a896111e3a11/89746941908.pdf
    • https://1eb42bdc-3da6-4b32-b75f-4382f1721f8e.filesusr.com/ugd/35474d_f5c30d512f7c4f5f96b93e3c74db3af7.pdf?index=true
    • https://58eafb2e-ea74-4523-a1b2-d2e0fe9bfe54.filesusr.com/ugd/466fa0_a7ba7f595d644239a57144ab1faee89b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8508e72c-b3e6-43d8-ad3b-53b8ace6f372/42236386492.pdf
    • https://uploads.strikinglycdn.com/files/32f52895-ed50-4144-90ff-3d359c6899bd/what_are_the_6_principles_of_gestalt.pdf
    • http://pagupim.epizy.com/20596980240.pdf
    • https://4a1cfc67-5981-466d-a13b-75576fe7431f.filesusr.com/ugd/64e449_bad5f74efece416d9bafa1f5c6cf670b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7b06da0a-97d1-4e49-9ac0-74acd77a8300/sukivu.pdf
    • https://uploads.strikinglycdn.com/files/b99a47c4-f9c6-46f9-a504-3549dc5039e6/xazewa.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.