Malicious PDF — malware analysis report

Static analysis result for SHA-256 be233f343a307939…

MALICIOUS

PDF

123.8 KB Created: 2021-04-04 18:56:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 4602a68c5697a266dc6729d15e43f659 SHA-1: f799b41357a62cbade8997103e08645ab287ed1f SHA-256: be233f343a3079397dd380440101267913ee887a390a599efd719d32a018d6fe
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, a technique often used for SEO poisoning or to redirect users to malicious sites. One prominent URL, 'https://resalured.ru/strik?utm_term=diablo+2+patch+1.13+download', suggests a lure for downloading game patches, which is a common phishing tactic. The ClamAV detection and ML classifier further indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7719

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=diablo+2+patch+1.13+download PDF link annotation
    • https://turoliletipusu.weebly.com/uploads/1/3/5/9/135969349/7249052.pdfIn PDF document text
    • http://useporte.xyz/eagle_scout_book_requirementsz3hh6.pdfIn PDF document text
    • http://siondez.ru/73002150765uaxi5.pdfIn PDF document text
    • https://zadukali.weebly.com/uploads/1/3/5/3/135340438/vaxagafef.pdfIn PDF document text
    • http://goldenframecollision.com/75920432453373gn.pdfIn PDF document text
    • https://kavosimodo.weebly.com/uploads/1/3/4/9/134901779/16624e4b2a5f.pdfIn PDF document text
    • http://perfectiona.online/mimadusezoxabidxcsob.pdfIn PDF document text
    • http://stakingyfi.com/el_completo_manual_del_suicida_onlinex3786.pdfIn PDF document text
    • http://bigwin-1xbet.fun/31377589807k1het.pdfIn PDF document text
    • http://copyrights-notices-helps.com/purawirok8g6xr.pdfIn PDF document text
    • https://s3.amazonaws.com/wewiro/dell_optiplex_780_display_drivers_for_windows_7_64_bit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28b773ca-65e5-411b-b02e-dafd9fc8c009/gapizamilijugu.pdfIn PDF document text
    • https://s3.amazonaws.com/fupanabivote/62455332977.pdfIn PDF document text
    • https://s3.amazonaws.com/xazarujokemus/67455039132.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70d602c3-d0e1-4382-bc8f-f113a1f4f021/jegapeveterulixipon.pdfIn PDF document text
    • https://s3.amazonaws.com/vefagotoje/gibukiripu.pdfIn PDF document text
    • https://s3.amazonaws.com/divikufifir/35522129448.pdfIn PDF document text
    • https://s3.amazonaws.com/remavuj/links_awakening_switch_walkthrough_zelda_dungeon.pdfIn PDF document text
    • https://s3.amazonaws.com/dixaleko/dizekizulukisajijik.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.