Malicious PDF — malware analysis report

Static analysis result for SHA-256 d46cc8284b55244f…

MALICIOUS

PDF

67.6 KB Created: 2021-01-25 13:36:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: bf25989ffa62f7686aa12488dbd31e3a SHA-1: 747b706377a031bcde688173cf084de9de499ee6 SHA-256: d46cc8284b55244fa2e8e7a11484706cbcc7d595985769e1947dd3dd66ac310b
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9035

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=stress+management+coping+skills+worksheet PDF link annotation
    • https://cdn.sqhk.co/pasojixaju/iaIjcAn/large_pencil_box_plastic.pdfIn PDF document text
    • https://cdn.sqhk.co/vejanozugova/ZETWHXw/28125750595.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501374/normal_5fc816d33cff5.pdfIn PDF document text
    • https://cdn.sqhk.co/koditisalupe/8BX9dzX/word_connect_answers_level_1517.pdfIn PDF document text
    • https://cdn.sqhk.co/gibuzini/LjjLWJp/2020_shelby_super_snake_truck_weight.pdfIn PDF document text
    • http://veronaital.space/zusab283zg.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374009/normal_5fe2b3a7f1ee5.pdfIn PDF document text
    • http://xsafak.com/homemade_burger_recipes_ukdgqtj.pdfIn PDF document text
    • http://zirosax.iblogger.org/9315446278.pdfIn PDF document text
    • http://kopavavabigi.66ghz.com/86962903922.pdfIn PDF document text
    • http://eroganoficial.site/382049395036hm6y.pdfIn PDF document text
    • http://distornyup.site/shooter_movie_cast_bob_lee_swaggerpnvrl.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4499309/normal_6008fe23370b4.pdfIn PDF document text
    • http://bejiteviv.epizy.com/rumemoniravajifi.pdfIn PDF document text
    • http://kofupugixujodin.epizy.com/pevijen.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.