Malicious PDF — malware analysis report

Static analysis result for SHA-256 bcad226670d454c2…

MALICIOUS

PDF

76.2 KB Created: 2021-03-15 05:28:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 97aa54a80f7095191e6466f1576c30b7 SHA-1: d637d764b0a25180184fa53e8a15e40affb3f058 SHA-256: bcad226670d454c2a37abcb0a5201ef4b76b0b235924920338b86a0ba9269593
182 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links that redirect to malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier and ClamAV also flagged this file as malicious. The primary malicious IOC is the redirector URL, which is likely used to host or deliver a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6145

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=absenteeism+and+presenteeism+pdf In PDF document text
    • http://fegiroxopirez.sportsontheweb.net/gafiwinejepumifukisupeza.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463277/normal_6021c10404046.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4375700/normal_5feb8f521763b.pdfIn PDF document text
    • http://wumomotetidofe.getenjoyment.net/67429913645.pdfIn PDF document text
    • http://zifufarox.getenjoyment.net/larisunajumuxiwakipado.pdfIn PDF document text
    • http://pegijegur.mygamesonline.org/woselapetipifuwefixuv.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460477/normal_5fe3c840960e4.pdfIn PDF document text
    • http://memaberenux.scienceontheweb.net/balanceamento_de_reaes_qumicas.pdfIn PDF document text
    • http://vomidujoma.scienceontheweb.net/what_are_the_5_categories_of_journalism.pdfIn PDF document text
    • http://duxepivol.myartsonline.com/33156798161.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/032b95a0-d5dd-49e1-b6ee-9539ab906691/python_for_loop_increment_index_inside_loop.pdfIn PDF document text
    • http://fozozip.onlinewebshop.net/41621581593.pdfIn PDF document text
    • https://s3.amazonaws.com/xezujuxoz/52365563640.pdfIn PDF document text
    • http://tevesuxaxil.rf.gd/xasopirilumoxelowamaw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47cef9a6-3455-4c5c-a0af-d650add9623a/volvo_penta_duo_prop_outdrive_parts_diagram.pdfIn PDF document text
    • http://veraliw.rf.gd/gojejuxenajezixewi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00d03e20-730b-4fbc-ba29-91fd2f0bd6bb/what_is_survival_of_the_fittest_theory.pdfIn PDF document text
    • https://s3.amazonaws.com/jenagubadopi/52901038177.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b94ddbb-131f-4e25-a750-faac39ec5bdb/nozulezixisubuzexurose.pdfIn PDF document text
    • https://s3.amazonaws.com/kezemiradigu/vijulovuvafajexog.pdfIn PDF document text
    • https://s3.amazonaws.com/fipijife/4325681515.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6c8c287-8719-431b-9ea2-4c85c7e68eb2/does_salvation_army_bell_ringers_get_paid.pdfIn PDF document text
    • https://s3.amazonaws.com/fefurorobumi/millers_falls_miter_box_74.pdfIn PDF document text
    • http://zijedan.atwebpages.com/digixejemoto.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.