Malicious PDF — malware analysis report

Static analysis result for SHA-256 cef70316a6c4719f…

MALICIOUS

PDF

65.3 KB Created: 2021-05-01 21:41:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: a113416e4f1b17cbbafcf146cda635b7 SHA-1: 0ca82bf063ced25478c0b1b914091e7f2afdd52d SHA-256: cef70316a6c4719fa42618ae360fa4827cc740b6fda80401438e8d59582527d1
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs, with one prominent URL leading to a suspicious domain. Heuristics indicate it's a link farm designed for disposable hosting, and ClamAV detected it as a phishing trojan. The document body, though heavily obfuscated, contains text related to an 'edgenuity quadratic functions unit test', suggesting a lure to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8827

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=edgenuity+quadratic+functions+unit+test PDF link annotation
    • https://cdn.sqhk.co/jizapamilizo/MG1tPic/xezeniboxepuxibak.pdfIn PDF document text
    • http://vegekezivujid.22web.org/92825118241.pdfIn PDF document text
    • https://cdn.sqhk.co/tarudifirew/Chc9q0q/86432158863.pdfIn PDF document text
    • https://cdn.sqhk.co/fifunolew/zz2eohb/escape_room_answers_level_21.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/57b45b04-a73e-40db-b476-c334ba6b4dcf/uncle_toms_children.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3be8cf6b-6372-4a45-ba07-48ad50f6b90e/22799829789.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4bfa867d-b9d6-49cb-becc-e70054973e83/que_significa_decir_como_agua_para_chocolate.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52c87b78-84c3-4bec-bd2b-5915936f9419/how_to_add_a_collar_to_sportdog_425.pdfIn PDF document text
    • http://puwufuwe.rf.gd/19683957025.pdfIn PDF document text
    • http://wuduzukatej.epizy.com/54954191036.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f4aa127-176a-453c-9286-762bcbd82e58/honda_gx160_pressure_washer_price.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e38af418-2ed2-416b-91a8-ed1af6a772dd/sudegevajakolevug.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46fb59ff-9b5d-46ea-998f-ac959028e335/how_to_glue_vinyl_to_wood.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5ecc393-2070-4992-a725-614be74bb66b/womipiwo.pdfIn PDF document text
    • http://puwomuf.rf.gd/fatelenogevomegelaxut.pdfIn PDF document text
    • http://laxuzakefojo.epizy.com/aladin_2009_full_movie_1080p.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31e96690-0aed-4f3e-8744-9f64df7fffa5/16463380363.pdfIn PDF document text
    • http://molitumulejoji.rf.gd/ankle_sprain_exercises_arthritis_uk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59609150-a682-41ac-b04d-7bea39dba1b7/gimoditinisefewurut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d34b3d7-6ac8-4245-9120-ce7556597bde/7504116292.pdfIn PDF document text
    • http://memaded.epizy.com/6860679160.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1bac0d1c-a950-439d-8ea3-ba61a8355b21/what_is_another_word_for_torah.pdfIn PDF document text