Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9554b9f7eaae743…

MALICIOUS

PDF

64.0 KB Created: 2021-04-02 13:45:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 035fb2bac84278de245ad98db19c1a3a SHA-1: f204e0b02a33306d00833dfed4aa4c8e9ad799bb SHA-256: b9554b9f7eaae7434be500c2a65729db607a134c5dbe96de252fca0f699b8219
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, many of which point to other PDF files, suggesting a link farm or redirection mechanism. The primary URL, 'https://baarspo.ru/strik?utm_term=how+to+determine+molecular+structure+from+nmr', is likely a lure to a phishing or malware distribution site. ClamAV and ML heuristics also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6428

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=how+to+determine+molecular+structure+from+nmr
    • https://cdn-cms.f-static.net/uploads/4403823/normal_6060f6e49559c.pdf
    • https://xapenivivafozeb.weebly.com/uploads/1/3/1/3/131379266/1612009.pdf
    • https://komuwewolidixat.weebly.com/uploads/1/3/4/8/134871085/wezajunawunemefemi.pdf
    • http://kewegagibemidaj.22web.org/80554258231.pdf
    • https://cdn-cms.f-static.net/uploads/4468550/normal_6042ed10d94d0.pdf
    • https://static.s123-cdn-static.com/uploads/4412896/normal_5ff46210acd17.pdf
    • https://kamapapidez.weebly.com/uploads/1/3/5/9/135962567/744749d4db2cb.pdf
    • https://cdn-cms.f-static.net/uploads/4460680/normal_602480a59c7ed.pdf
    • https://wobelafesuta.weebly.com/uploads/1/3/4/7/134767333/bexazinelumik.pdf
    • http://wedudixunuluwef.iblogger.org/tybsc_it_syllabus_mumbai_university_2020_19.pdf
    • https://static.s123-cdn-static.com/uploads/4413122/normal_5fe2b92d5e7c0.pdf
    • https://cdn-cms.f-static.net/uploads/4444877/normal_602775ca4a1eb.pdf
    • https://cdn-cms.f-static.net/uploads/4408001/normal_602a1a4befc44.pdf
    • https://newakikijako.weebly.com/uploads/1/3/4/3/134351088/4579837.pdf
    • https://davugunibelerab.weebly.com/uploads/1/3/4/6/134612729/wubitakozolegi.pdf
    • https://cdn-cms.f-static.net/uploads/4495526/normal_605b6f2736398.pdf
    • http://wokesoz.epizy.com/78951570186.pdf
    • http://fefaborap.rf.gd/tebiwokepepu.pdf
    • http://wokixewo.epizy.com/vigudupapejedibevi.pdf
    • http://jabizamok.epizy.com/text_message_app_for_android.pdf
    • http://gesovupa.epizy.com/43077275995.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.