Malicious PDF — malware analysis report

Static analysis result for SHA-256 da4145c107779566…

MALICIOUS

PDF

51.7 KB Created: 2021-04-01 14:23:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3811d3d7da2f0bee8475f6fcf1e3cfb6 SHA-1: 6225c2e7de2989150e49d4aa5e265f7db6da6062 SHA-256: da4145c107779566ac38f801dda134c449fdb8cc721e42c2ad7a5ac9a8676d96
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its small size, image-heavy content, and embedded clickable links. The heuristic 'PDF_IMAGE_LURE' specifically indicates this tactic. The presence of numerous external URLs, including one flagged by ClamAV as 'Pdf.Phishing.Trojan', strongly suggests a malicious intent to redirect users to phishing sites or download further malicious content. No scripts were extracted, but the PDF structure itself is designed to facilitate malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6386

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 51 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=aircraft+airframe+book+pdf
    • https://cdn.sqhk.co/vamalowawepi/GB9I9if/bilasefa.pdf
    • https://cdn.sqhk.co/gelowidabik/je61hdu/20695351928.pdf
    • http://morasuxod.getenjoyment.net/sojej.pdf
    • http://all-gopro.com/kojazakesudemibinejomusxo7l.pdf
    • https://cdn.sqhk.co/jibanukagexa/gigEt8i/i_love_you_priya_tamil_ringtone.pdf
    • http://onesmall.space/assembler_plusieurs_en_1_seulujzes.pdf
    • https://cdn.sqhk.co/sevimifogu/RDSgfii/48870548387.pdf
    • http://gladkoe-telo.xyz/the_lion_king_full_movie_2019_castvb383.pdf
    • https://cdn.sqhk.co/mekerijiwuv/1dihMih/35364384127.pdf
    • http://prequester.online/how_to_pair_microsoft_bluetooth_designer_keyboardxbvli.pdf
    • http://rineset.xyz/satigomolotubikty29.pdf
    • https://cdn.sqhk.co/jenireni/jcN3wjb/majujowutitebuwujiz.pdf
    • http://tipijijajofupi.sportsontheweb.net/bible_study_lessons_for_youth.pdf
    • https://cdn.sqhk.co/totarujined/e3Ehhhc/perfect_attendance_certificate_template.pdf
    • http://wilanutoroguzif.rf.gd/henri_lloyd_jumper_size_guide.pdf
    • https://90ff81fc-98d9-4e53-96a3-aaa5c1c2042e.filesusr.com/ugd/bb5aff_c972de1b65d14621a45ec8baf11495d4.pdf?index=true
    • http://kisezemewarajox.rf.gd/how_to_eat_2000_calories_a_day_vegetarian.pdf
    • http://vewemisesafi.epizy.com/obras_de_alvaro_mutis.pdf
    • https://3df06c22-1e8a-4082-8cc2-a0fdc0609706.filesusr.com/ugd/d86e81_ccf4f6321a444dea9c6ed736d76cedd4.pdf?index=true
    • https://391e4f24-9fc9-4707-ac06-338edcd9f959.filesusr.com/ugd/110ef3_4406f2ea073742eda98f9c03b0898be3.pdf?index=true
    • http://wewamamewiler.atwebpages.com/how_to_use_usb_in_set_top_box.pdf
    • https://237a2310-9536-43ad-add1-fe73b840a51a.filesusr.com/ugd/8b319d_64434a2864444d3c80958e1e787279b2.pdf?index=true
    • http://ratazudawi.epizy.com/bowenpally_sai_songs.pdf
    • http://xomexopiguv.rf.gd/15417701242.pdf
    • https://d74058ad-8c31-4576-aeb4-582a73b10e1e.filesusr.com/ugd/666c83_a8f75623a7104449becf177809b0eb0e.pdf?index=true

Open this report in the interactive analyzer, or submit your own file for analysis.