Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9bb5c9b4291f798…

MALICIOUS

PDF

57.8 KB Created: 2021-04-16 12:18:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 9a0c0c978246619ff51712dea5764039 SHA-1: 8d5bb7dc88bd225fd4ea121d058c6579d4028aeb SHA-256: c9bb5c9b4291f798879b15700dd52e18f188fcf59bd84f896747a0c8b30b7f6b
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5491

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=is+ps+vita+store+closing PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4494891/normal_6052814ab7b0b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455406/normal_5ffe9a6fb555d.pdfIn PDF document text
    • http://womenalikumat.22web.org/52731425662.pdfIn PDF document text
    • http://monabis.iblogger.org/roku_3_controller_not_working.pdfIn PDF document text
    • http://reawolt.online/13312187591xkvbu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402503/normal_5fe95cf6dd2a1.pdfIn PDF document text
    • http://azorocheat1.xyz/99331004824nbtbw.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4447464/normal_5fe03f46640f5.pdfIn PDF document text
    • http://realnoe-obshenie.online/best_free_bass_booster_for_pctuv0e.pdfIn PDF document text
    • http://antinomi.design/642381328647ovoq.pdfIn PDF document text
    • http://dnepr24.info/thanks_maambrysj.pdfIn PDF document text
    • http://juwemijawikipo.epizy.com/.pdfIn PDF document text
    • https://0dea665b-aaaa-42f3-a52c-f86f0fd1efa2.filesusr.com/ugd/8b9728_bef4e94ef3f64d8681da23ad885128dd.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/aac6c008-4b48-4150-8514-6ab8d38ab6c4/goldstar_microwave_parts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eebc1782-a43f-45a0-926d-0ff86f6c1f69/a1c_11.7_conversion.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d42dac08-f17b-485c-85e1-53fdfcc0a60d/joseph_campbell_the_hero_with_a_thousand_faces_amazon.pdfIn PDF document text
    • https://8d6920c1-aef5-45ed-b1a0-e693d63948fb.filesusr.com/ugd/0a593f_4856e23b52c947539baf0c07cbacb81b.pdf?index=trueIn PDF document text
    • http://xofovepalij.epizy.com/barium_swallow_procedure.pdfIn PDF document text
    • https://30cc9e9c-6145-4029-bfdc-d0561bdb3a10.filesusr.com/ugd/0dcf4b_e5c8e13443c04fcc9e574920d138164f.pdf?index=trueIn PDF document text
    • http://mawivevixovoxet.epizy.com/26047509465.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a842c56-1a4b-452d-bebe-2aea77742dd1/how_to_play_classical_guitar.pdfIn PDF document text
    • https://9d1e48ad-bcd7-4831-9b7b-7108443a63b6.filesusr.com/ugd/136d07_ab0dd6dfabdb4560b8f4172d1c6bd5ed.pdf?index=trueIn PDF document text
    • http://soworuniranemum.epizy.com/job_cost_sheet_excel_template.pdfIn PDF document text
    • http://januxalak.rf.gd/luzugi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/da43c217-499d-472f-b1a0-689e04dfd188/subtraction_across_zeros_worksheet.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.