Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7d348da5d8159cf…

MALICIOUS

PDF

54.5 KB Created: 2021-03-14 10:24:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: c2ef0f9921ea707fdc603dd36dd75c64 SHA-1: fc5ccc414a38dfefc527e89f3186b77c38afbd28 SHA-256: c7d348da5d8159cf48fb35d96d58db7aba9d41f91f30928c2b181fcc426685f9
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8115

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/award?keyword=land+reform+policy+pdf PDF link annotation
    • https://gawupuvuto.weebly.com/uploads/1/3/4/5/134530234/naributibop.pdfIn PDF document text
    • https://cdn.sqhk.co/fononedegot/AthbhcE/22430132555.pdfIn PDF document text
    • https://cdn.sqhk.co/muvotugi/Xuhbide/smart_classes_in_high_school_for_lawyers.pdfIn PDF document text
    • http://tibagisuminove.sportsontheweb.net/math_olympiad_word_problems.pdfIn PDF document text
    • https://gopasijokalurat.weebly.com/uploads/1/3/5/3/135399025/bagebagonijedosuf.pdfIn PDF document text
    • https://cdn.sqhk.co/murajefovel/gdajjjb/lupivovasutikojum.pdfIn PDF document text
    • http://fuwijumazawad.mywebcommunity.org/school_annual_day_anchoring_script.pdfIn PDF document text
    • https://cdn.sqhk.co/giwitosak/jbqShel/plant_vs_animal_cells_differences.pdfIn PDF document text
    • https://cdn.sqhk.co/defisepeniba/fc6gjje/the_wolf_of_wall_street_trailer_download.pdfIn PDF document text
    • https://cdn.sqhk.co/lenubire/helCjcL/zixudize.pdfIn PDF document text
    • https://cdn.sqhk.co/fazituku/Bgi9Hjh/list_of_skin_colors_in_spanish.pdfIn PDF document text
    • https://jubolovewo.weebly.com/uploads/1/3/1/4/131453214/5639683.pdfIn PDF document text
    • http://gamuxiwami.getenjoyment.net/90734534948.pdfIn PDF document text
    • http://xarilupinedup.myartsonline.com/hindu_marriage_biodata_format_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8efae48-89b1-4478-a92e-0441aba25cac/how_to_calculate_t_score_and_z_score.pdfIn PDF document text
    • http://xovolefewawex.atwebpages.com/d-link_powerline_utility_mac.pdfIn PDF document text
    • http://pasifowon.atwebpages.com/17225841988.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f7601166-4216-42e7-b923-b56898e7bdcc/epson_3020_projector_price_in_india.pdfIn PDF document text
    • http://tapoloferazuziw.atwebpages.com/14824829185.pdfIn PDF document text
    • http://wujagenak.atwebpages.com/crayon_box_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c710a526-03d4-4e87-b068-055e06b54db4/bofesevulifenaxot.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.