PDF malware analysis — malicious · b9d04f03f3c33267

MALICIOUS

PDF

57.2 KB Created: 2021-03-14 04:20:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2f979d87fe0a3b91e7ff798412ce9619 SHA-1: 97db5da2a0c35f05cd8c87020c77a8af7702ab79 SHA-256: b9d04f03f3c33267445299cdd7afd16e98a5a320454d9836d6032bac0b0e98ec

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF is identified as malicious by ClamAV and exhibits characteristics of a phishing lure, including an image-only presentation and numerous embedded external links. The heuristics indicate a potential link farm designed to redirect users to malicious sites, likely for credential harvesting or malware distribution. No scripts were extracted, but the PDF structure itself is indicative of a phishing attack.

Machine Learning

Nyx PDF Classifier malicious score 0.5074

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 57 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/award?keyword=science+of+the+total+environment+pdf
- https://cdn.sqhk.co/bogebumemilo/hgifJgg/does_music_increase_productivity_at_work.pdf
- https://talupujepanuzan.weebly.com/uploads/1/3/4/5/134595677/lavulu.pdf
- https://cdn.sqhk.co/janonaset/M3hajat/29470906024.pdf
- http://kazimibi.getenjoyment.net/roxoxusosefevut.pdf
- https://cdn.sqhk.co/sakupiraf/thfihcn/hamlet_penguin_readers_level_3.pdf
- https://xajimago.weebly.com/uploads/1/3/0/8/130813364/5792542.pdf
- https://cdn.sqhk.co/neseleko/chihdhg/pixel_survival_games_mod_apk.pdf
- https://wabodaji.weebly.com/uploads/1/3/2/6/132681772/rujuti.pdf
- https://cdn-cms.f-static.net/uploads/4454163/normal_604792ff10334.pdf
- https://cdn.sqhk.co/muligumixe/tjijgih/magedala.pdf
- https://cdn-cms.f-static.net/uploads/4448991/normal_604a865b82959.pdf
- http://fukazab.mywebcommunity.org/how_do_i_connect_my_hp_deskjet_3051a_to_wireless.pdf
- https://jakemujilofadam.weebly.com/uploads/1/3/1/3/131380171/bubix.pdf
- http://zumewidife.mygamesonline.org/what_are_some_good_topics_for_an_argumentative_essay.pdf
- https://static.s123-cdn-static.com/uploads/4386607/normal_600864a4e1bbc.pdf
- https://s3.amazonaws.com/widiku/beneficial_ownership_model_certification_form.pdf
- https://s3.amazonaws.com/zonebon/762497133.pdf
- https://s3.amazonaws.com/vokeri/pufanisezivuduwofijerifi.pdf
- https://uploads.strikinglycdn.com/files/d49edbaa-7c4c-4649-9127-78f2ac368808/47407290854.pdf
- https://uploads.strikinglycdn.com/files/177b6d27-f44e-43e4-9f7f-5de0d89be385/bose_lifestyle_25_remote_not_working.pdf
- https://uploads.strikinglycdn.com/files/b6deb121-66c4-495c-a746-c98348080ed4/79928813790.pdf
- https://uploads.strikinglycdn.com/files/cb3ac030-8777-4421-ae0e-a60fa3399bb9/john_deere_72_mower_deck_parts_list.pdf
- https://uploads.strikinglycdn.com/files/ef24a670-a2fb-46ba-8e56-724190620365/kedazivuvuwefikofotifu.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.