Malicious PDF — malware analysis report

Static analysis result for SHA-256 da67e7b50e63accb…

MALICIOUS

PDF

58.6 KB Created: 2021-03-19 13:16:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6eb62d2f828394f09344791f6154fb35 SHA-1: ba1335a9161e98582602810c7f24b476eb28b28d SHA-256: da67e7b50e63accbd2063bea62cb5c90473cd029fa17be450c78682dffd4a956
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was identified as malicious by multiple heuristics and a machine learning classifier, with ClamAV detecting it as Pdf.Phishing.Trojan. The PDF contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or distribution mechanism. The document body contains garbled text, indicating it is not intended for direct user interaction but rather to host these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9902

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=beginner+vocabulary+english+pdf
    • https://nugijokokul.weebly.com/uploads/1/3/0/9/130969158/ponalefojonul_taxogodozeke_gedirujonu.pdf
    • https://janepowowufevi.weebly.com/uploads/1/3/4/5/134506071/soxuselebopil.pdf
    • https://zaruneza.weebly.com/uploads/1/3/2/8/132814400/nukogutojorukupug.pdf
    • https://bimuwalunamen.weebly.com/uploads/1/3/1/3/131384226/jedezosizinanufenov.pdf
    • https://suviliter.weebly.com/uploads/1/3/1/4/131453542/vapuxanopuriw.pdf
    • https://latabiwot.weebly.com/uploads/1/3/4/6/134612911/cff855bbd7.pdf
    • https://zozesikijep.weebly.com/uploads/1/3/4/5/134586683/3425080.pdf
    • https://daxivikulogator.weebly.com/uploads/1/3/4/3/134308382/monulu-vowemigumozulif-jopuvamofe.pdf
    • https://wafiludelo.weebly.com/uploads/1/3/1/4/131437380/gagexa-pumatuxadamek-dejuwad-wofamiv.pdf
    • https://pudorexejuvaw.weebly.com/uploads/1/3/1/4/131455832/bumaz.pdf
    • https://gifiboluf.weebly.com/uploads/1/3/2/6/132681188/d7e777f658f8.pdf
    • https://gotedimonov.weebly.com/uploads/1/3/4/7/134761190/773799.pdf
    • https://tujobofawoti.weebly.com/uploads/1/3/2/6/132695409/e61dc.pdf
    • https://ritipovilij.weebly.com/uploads/1/3/4/6/134650849/07fee.pdf
    • https://xavuzilutose.weebly.com/uploads/1/3/1/0/131070872/3021748.pdf
    • https://s3.amazonaws.com/tizowodifi/en_nombre_de_la_rosa_libro_completo.pdf
    • https://uploads.strikinglycdn.com/files/0a2040e9-9d43-435a-baab-161092efd944/78355413373.pdf
    • https://s3.amazonaws.com/pogolo/lost_wax_casting_process_steps.pdf
    • https://uploads.strikinglycdn.com/files/3a516ff9-fc59-488b-ac93-ff6b2d6cec03/67742897402.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.