Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfa8362a39e93e80…

MALICIOUS

PDF

38.1 KB Created: 2021-03-05 19:18:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: c42d9ab544b33db7b92e9e580996ada2 SHA-1: 616c6d16d3a8df1e0f6126a51b395e018eab81e2 SHA-256: cfa8362a39e93e80c20522d9d20cf1c054e12be5a495035acc09489f5179170f
262 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document functions as a phishing lure, presenting itself as a worksheet answer key to entice users to click a malicious link. The link redirects to a known malicious infrastructure, indicating an attempt to deliver a secondary payload or phish for credentials. The document's structure and embedded links suggest it is part of a link farm designed to improve search engine ranking for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 38 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/aws?utm_term=gravity+and+motion+worksheet+answer+key+pearson In PDF document text
    • https://cdn.sqhk.co/vipujitebiki/hhcjjq5/star_wars_movies_ranked_by_popularity.pdfIn PDF document text
    • http://zifujujefilat.iblogger.org/65273764947.pdfIn PDF document text
    • https://cdn.sqhk.co/dewufidabo/jLVgeie/lord_of_the_seven_kingdoms_title.pdfIn PDF document text
    • https://cdn.sqhk.co/xoxapivasif/ghiKihG/did_you_know_food_safety_facts.pdfIn PDF document text
    • https://cdn.sqhk.co/gumoxixo/ajjgcyX/republique_bananiere_traduction.pdfIn PDF document text
    • http://texoraw.sportsontheweb.net/what_is_taco_bells_new_5_box.pdfIn PDF document text
    • http://webomiwizux.22wIn PDF document text
    • https://s3.amazonaws.com/farefasejikap/rapafefepezorik.pdfIn PDF document text
    • http://gototura.myartsonline.com/2013_subaru_wrx_sti_engine_specs.pdfIn PDF document text
    • https://eb62986f-0112-409a-9ebe-777412bc5c19.filesusr.com/ugd/26938b_bf2a39ed93954b528453130b853a6538.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/banula/audiolibro_jj_benitez_caballo_de_troya_3_saidan_voz_humana.pdfIn PDF document text
    • https://9042e326-c85f-44e6-b9b6-0c206471fdba.filesusr.com/ugd/0d2fda_bf788f6897f94b098c60570f0bee7e6b.pdf?index=trueIn PDF document text
    • https://cd70d4e5-4a1a-4071-96d1-f2415ea5ece1.filesusr.com/ugd/7f46b5_567033d70d17437296f6ba6c9497f77f.pdf?index=trueIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.