PDF malware analysis — malicious · c47aaabc88286077

MALICIOUS

PDF

112.3 KB Created: 2021-09-17 03:47:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14

MD5: 5f5ed200495ac5538a3097e13898f204 SHA-1: 46982619fcebb099997cbcbeb254b061ae009d06 SHA-256: c47aaabc882860771b8c325c53789aa5b271e1a759d150b38ba654c2b7b45efa

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including ML classification and ClamAV, indicating malicious content. It contains numerous embedded URLs pointing to disposable domains, suggesting a link farm or phishing lure. The presence of PDF_URI and EMBEDDED_URL heuristics further supports the attack pattern of directing users to external malicious resources.

Machine Learning

Nyx PDF Classifier malicious score 0.5649

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://garglob.ru/uplcv?utm_term=quantum+mechanics+a+modern+development+pdf PDF link annotation
- https://hongdung.vn/ckeditor/images/files/rekozuf.pdfIn PDF document text
- http://vmkmsz.hu/userfiles/file/vexowosagakovugipu.pdfIn PDF document text
- https://aurorabersinar2.com/contents/files/90056115002.pdfIn PDF document text
- http://odontoflash.eu/userfiles/files/73071085594.pdfIn PDF document text
- http://skontrolsengineering.com/file_media/file_image/file/binuratibilulujebake.pdfIn PDF document text
- https://digireg.ch/upload/jufafisiralutudekex.pdfIn PDF document text
- https://lecachet.fr/docs/files/sufenode.pdfIn PDF document text
- https://lesrimaudieres.com/images/uploads/file/xiwasisosunitezejuz.pdfIn PDF document text
- http://changwontour.kr/FileData/ckfinder/files/20210909_A2ECE666DB746397.pdfIn PDF document text
- http://suliaox.com/v15/Upload/file/202192124824032.pdfIn PDF document text
- http://ulv-fogger.ru/d/files/kexokagirojudu.pdfIn PDF document text
- http://kirsanov-maslo.ru/uploads/72517233312.pdfIn PDF document text
- http://belloverde.net/emailer/file/39063633318.pdfIn PDF document text
- http://tms-technology.com/ckfinder/userfiles/files/fetikugukerawi.pdfIn PDF document text
- https://giaynangchieucao.com/userfiles/file/51730502040.pdfIn PDF document text
- https://braindevelopmentmaps-org.neurondevelopment.org/userfiles/files/94634470093.pdfIn PDF document text
- http://www.gamylai.vn/uploads/files/fufasusosileseduxivarejap.pdfIn PDF document text
- https://zippy-inc.com/app/webroot/userfiles/files/33334310176.pdfIn PDF document text
- https://okinawa4d.com/contents/files/favusareviwiwosaju.pdfIn PDF document text
- http://becro-plast.hr/wp-content/plugins/formcraft/file-upload/server/content/files/16136a947c5ae0---pamoruriri.pdfIn PDF document text
- http://toyotaquangninh.org/data/dulieu/files/73167846228.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.