Malicious PDF — malware analysis report

Static analysis result for SHA-256 db6358a3ad6d99a6…

MALICIOUS

PDF

58.2 KB Created: 2021-03-19 17:01:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: aff99f57e29857aba4f27b61772dd1f8 SHA-1: 536bb2db15795273150e8666a274857d813444cc SHA-256: db6358a3ad6d99a6d50495c93573e993790c2723107c5558879cad8d5e4debbc
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, a technique often used for SEO manipulation or to redirect users to phishing sites. ClamAV and ML classifiers also flagged this file as malicious, specifically identifying it as a phishing trojan. No scripts were extracted, but the embedded URLs are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8300

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+many+ways+i+love+you+poem PDF link annotation
    • https://bigudiwox.weebly.com/uploads/1/3/5/3/135304820/vemulibiborosibupol.pdfIn PDF document text
    • https://lemamoramu.weebly.com/uploads/1/3/5/3/135348447/goketazukego.pdfIn PDF document text
    • https://fobibopokigafo.weebly.com/uploads/1/3/4/7/134702456/vanipibodat-nokos-divixuwawesavex-dosijipumewad.pdfIn PDF document text
    • http://francobusiness.com/resume_templates_in_wordg02r3.pdfIn PDF document text
    • https://jozisanolotodix.weebly.com/uploads/1/3/0/9/130969335/jotufugopuven-rirarikame-diwodajav.pdfIn PDF document text
    • http://peuly.xyz/how_many_cubic_feet_is_a_super_capacity_plus_washershbch.pdfIn PDF document text
    • http://neyroskakalka.site/winning_toefl_essays_the_right_way78o9h.pdfIn PDF document text
    • http://ppl-nutrshopfit.website/43140389635w5fmb.pdfIn PDF document text
    • http://garantiya62.ru/42198614064lmhop.pdfIn PDF document text
    • https://bdee3e82-1fe6-4084-b289-f15f5249f83e.filesusr.com/ugd/749937_635abeef44024a8eb6126bd9e1e309e6.pdf?index=trueIn PDF document text
    • https://2c91b947-1dd8-401e-ae91-d595f2f75867.filesusr.com/ugd/0af078_0f08c6f279a8457490a6f6a9c1bda870.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/suzixegazunow/koluloximiv.pdfIn PDF document text
    • https://s3.amazonaws.com/potofaw/2016_ford_f_150_forscan_spreadsheet.pdfIn PDF document text
    • https://dc6b22d1-fd3c-476a-b8f1-b0505981f591.filesusr.com/ugd/ab5adf_ff7d359f9def4b57ad91ba32dc8805b3.pdf?index=trueIn PDF document text
    • https://5c3e38fa-bf2d-4cda-bfdc-19e9a39f2227.filesusr.com/ugd/b3ada4_f4c483a7078b4fd4a002338365e2d260.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/golixebemakikenupegetimo.pdfIn PDF document text
    • https://s3.amazonaws.com/didowugorokirug/40076641856.pdfIn PDF document text
    • https://s3.amazonaws.com/liguwubore/one_informal_agency_of_social_control.pdfIn PDF document text
    • https://s3.amazonaws.com/norozovijalu/steve_harvey_book_90_day_rule.pdfIn PDF document text
    • https://s3.amazonaws.com/votawawo/instruction_manual_whirlpool_gold_series_dishwasher.pdfIn PDF document text
    • https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_2865329ee0cb487694a8727c076d10cc.pdf?index=trueIn PDF document text
    • https://d848e4b6-662b-4424-a759-963270729452.filesusr.com/ugd/30e015_6ec05a8114bf4ba7a2bd391586df53a2.pdf?index=trueIn PDF document text
    • https://51fd5013-30c4-43d1-89ce-86564632a3b5.filesusr.com/ugd/9f06f8_ba625231399a49c4b5c340e83ba9d05c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jedadokuti/fonilizemipodaxok.pdfIn PDF document text
    • https://s3.amazonaws.com/desekusoxi/gm_diet_plan_day_1_weight_loss.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.