PDF malware analysis — malicious · d23e700bfda2e847

MALICIOUS

PDF

64.0 KB Created: 2021-03-26 18:50:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 60e86fc02e5bfb765fa3469227b30c69 SHA-1: 21f299c191d3964762f72886fed3625128fc887f SHA-256: d23e700bfda2e8470da04ecfe0cad2735f20c3544163ab371698ceb849cdcceb

182 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs, with a critical heuristic firing indicating a link to known malicious redirector infrastructure. The ML classifier also flagged the PDF as malicious. The primary IOC is the redirector URL, which likely leads to a phishing or malware download site.

Machine Learning

Nyx PDF Classifier malicious score 0.5377

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/award?keyword=cursive+writing+practice+sheets+sentences+pdf
- http://rozel.ru/22918197729kgb7j.pdf
- http://znakomstva69.space/avisos_de_ocasion_informador_telefonoz3gl0.pdf
- http://storeeu.info/vias_de_administracion_de_medicamentostq8ui.pdf
- http://russianstravel.ru/kixemogoxusinaniledojafe24vcj.pdf
- http://latencfsrt.space/797044473089mq0k.pdf
- http://fruittea.space/matematiin_gnlk_hayatta_kullanld_yerlerppa89.pdf
- https://wepulawako.weebly.com/uploads/1/3/4/0/134096509/wavisutonefejixo.pdf
- http://atelier-spb.com/mcgraw_hill_education_booksbvlr5.pdf
- http://evromotors.net/65135127360mvsjp.pdf
- http://tibagisuminove.sportsontheweb.net/the_little_book_of_common_sense_investing_review.pdf
- http://am-sound.ru/nopunavijulisugovosojeox88x.pdf
- https://kiwiwutirove.weebly.com/uploads/1/3/4/7/134707888/f8e62f.pdf
- http://latencfsrt.space/the_crown_season_2_episode_4_wiki0blpz.pdf
- https://pomorewosijimop.weebly.com/uploads/1/3/2/6/132681296/b91c75ada.pdf
- https://s3.amazonaws.com/kefiperizonofu/worksheet_context_clues_2nd_grade.pdf
- https://uploads.strikinglycdn.com/files/6d401cd3-1799-4b19-bd42-6502ec1a2068/why_silica_gel_g_is_used_in_tlc.pdf
- https://uploads.strikinglycdn.com/files/d58a874d-2a8f-4872-a102-274cdb0a62d2/taoist_quotes_chuang_tzu.pdf
- http://mujebik.atwebpages.com/beckmann_and_ling_s_obstetrics_and_gynecology_8e.pdf
- https://uploads.strikinglycdn.com/files/ab0c3bc2-aae6-4b38-9379-0cc14c0f8073/jujosebuzenafimalofik.pdf
- https://s3.amazonaws.com/xijuxosisomuna/45797196358.pdf
- https://uploads.strikinglycdn.com/files/a2a3fa65-a1d9-4602-befb-4e113257412b/what_does_audacity_mean_in_farsi.pdf
- http://bitujiduruv.myartsonline.com/octavia_butler_wild_seed.pdf
- https://s3.amazonaws.com/zarusegibitumet/46598365514.pdf
- http://pusebirenox.myartsonline.com/what_oil_does_a_bmw_330i_take.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.