Malicious PDF — malware analysis report

Static analysis result for SHA-256 c03daca5a6a56485…

MALICIOUS

PDF

51.2 KB Created: 2020-11-18 12:09:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fd7b6a0086432cd10bb1f4708cd3c3e1 SHA-1: 49b4fbf4e1f14d77f6ae774eedcff88ff30e199f SHA-256: c03daca5a6a56485c0aa3ebee9d6183cafeeff7858c47b37f9fc172a542749d7
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links, one of which points to a known malicious redirector. The document body, though heavily obfuscated, contains text suggesting a lure for 'xim apex manager pc'. The presence of numerous external PDF links, many hosted on S3, indicates a link farm used for SEO poisoning or distributing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8405

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=download+xim+apex+manager+pc
    • https://cdn-cms.f-static.net/uploads/4382421/normal_5f8cae6a837ab.pdf
    • https://cdn-cms.f-static.net/uploads/4413121/normal_5faf4f97610cb.pdf
    • https://dosarowit.weebly.com/uploads/1/3/4/3/134315771/gavofuj.pdf
    • https://bevikafu.weebly.com/uploads/1/3/4/7/134710030/bejinu-fopav-xefoge.pdf
    • https://pafudufuwod.weebly.com/uploads/1/3/4/3/134326080/4f07252deb18e3.pdf
    • https://cdn-cms.f-static.net/uploads/4387421/normal_5fa8bc2616449.pdf
    • https://jokatilowiwege.weebly.com/uploads/1/3/4/3/134369617/4de2b.pdf
    • https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/6620064.pdf
    • https://cdn-cms.f-static.net/uploads/4391305/normal_5f9e532d29f08.pdf
    • https://s3.amazonaws.com/sugaguxagu/50673350044.pdf
    • https://s3.amazonaws.com/gifiz/wow_wotlk_mm_hunter_pvp_guide.pdf
    • https://s3.amazonaws.com/wapabefizosumi/barbie_cash_register_walmart.pdf
    • https://s3.amazonaws.com/metubevozisul/botemarizetux.pdf
    • https://s3.amazonaws.com/lomogas/86722328962.pdf
    • https://s3.amazonaws.com/sinadi/toxabekefusufobivavuz.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.