Malicious PDF — malware analysis report

Static analysis result for SHA-256 c70285abe9250c2f…

MALICIOUS

PDF

49.6 KB Created: 2021-02-28 03:56:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: e365de0cf2430ce48aaea81e347230df SHA-1: 73af152897cf3e844d61cf1a61223c82d05a3f14 SHA-256: c70285abe9250c2fd3965fe6a97f820fd21ca2fdc664755649bfa28b37ccbd32
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7360

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/aws?utm_term=rowenta+x+cel+steamer+reviews PDF link annotation
    • https://vutepunuvo.weebly.com/uploads/1/3/1/6/131637517/228919c1.pdfIn PDF document text
    • https://xopavomubikun.weebly.com/uploads/1/3/4/8/134879687/68fa9f1f99ae02.pdfIn PDF document text
    • http://jawazapefaxuzit.mywebcommunity.org/how_to_find_a_weakness_in_an_article.pdfIn PDF document text
    • https://nusutaligufobam.weebly.com/uploads/1/3/5/3/135393176/4932198.pdfIn PDF document text
    • https://cdn.sqhk.co/roretuduva/jetjc7v/cracker_barrel_thanksgiving_sides.pdfIn PDF document text
    • https://zozizifubigidoz.weebly.com/uploads/1/3/1/4/131409074/87a766d2f.pdfIn PDF document text
    • https://cdn.sqhk.co/wenegifuteg/gmbTidN/my_arcade_pocket_player_handheld_game_console.pdfIn PDF document text
    • http://xuvaxujogilo.mygamesonline.org/levusigenuxunijig.pdfIn PDF document text
    • https://lakowabanitewot.weebly.com/uploads/1/3/4/8/134898259/gulaki.pdfIn PDF document text
    • https://xojozojejaxito.weebly.com/uploads/1/3/4/8/134866115/semiwi-sixuwaduxubaguf-jixovefefeku-motoranidelu.pdfIn PDF document text
    • https://cdn.sqhk.co/jerivudofin/bNnighh/ice_cream_cake_strain_yield.pdfIn PDF document text
    • http://zisukuvi.atwebpages.com/outlander_diana_gabaldon_next_book.pdfIn PDF document text
    • https://s3.amazonaws.com/gekixadonuru/biometrical_journal_author_guidelines.pdfIn PDF document text
    • http://samesesodore.onlinewebshop.net/what_holidays_are_celebrated_in_el_salvador.pdfIn PDF document text
    • https://s3.amazonaws.com/zetubakuz/29745914802.pdfIn PDF document text
    • https://s3.amazonaws.com/vufuzewasi/appreciation_email_reply_format.pdfIn PDF document text
    • https://s3.amazonaws.com/baxunaf/teamviewer_free_for_windows.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.