Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd64eb8bcaf5692e…

MALICIOUS

PDF

46.2 KB Created: 2021-03-21 09:11:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd9f1aaa417f6f4443d8ac125eb67375 SHA-1: 24bf68da620fe4465a10feb2b45340c7de2dc185 SHA-256: dd64eb8bcaf5692efaee5204b383c7a491ded352fc89e8f224c8fcc84f04dbdd
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical of phishing campaigns, and contains numerous external links, including one to a potentially malicious domain. ClamAV and ML classifiers also flagged this file as malicious. The presence of embedded URLs and the document's structure strongly suggest it's part of a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8240

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 46 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=cali+move+workouts+pdf+download
    • http://apsmall.space/12824761050l9lm8.pdf
    • https://polavimiwusirew.weebly.com/uploads/1/3/2/6/132681763/gokurifegosejatem.pdf
    • http://swiss-gear.store/suunto_vyper_novo_vs_lite61vyg.pdf
    • http://parrrtner.xyz/dubixipepasenifii79fu.pdf
    • http://hellesypakk.online/monitorear_trafico_de_red_wifis4bn2.pdf
    • https://static.s123-cdn-static.com/uploads/4366665/normal_6002b6c694d86.pdf
    • http://uplrezina.site/grand_chase_mobile_elesis_guidecsyvm.pdf
    • http://muldwych.com/adipex_meal_planq35kc.pdf
    • https://dubiroki.weebly.com/uploads/1/3/1/4/131483307/xikado.pdf
    • https://cdn-cms.f-static.net/uploads/4484636/normal_604f2993aa545.pdf
    • https://cdn-cms.f-static.net/uploads/4412592/normal_6016fa4c9fce6.pdf
    • https://zuparimetusu.weebly.com/uploads/1/3/1/3/131378993/sejora_samuwu_tejelojokaja.pdf
    • http://damvglaz2.xyz/descargar_worms_2_armageddon_para_androidiy7rp.pdf
    • https://memetunariva.weebly.com/uploads/1/3/1/4/131454345/lugozuvevise_jiliselove_dobet.pdf
    • http://summerita.fun/88506986819wexce.pdf
    • https://s3.amazonaws.com/jafujasiwetid/jixusidu.pdf
    • https://s3.amazonaws.com/ravuxudibure/what_questions_do_genetic_counselors_ask.pdf
    • https://s3.amazonaws.com/xisakazelelinim/jomafimo.pdf
    • https://s3.amazonaws.com/sulasatevirexo/iphone_x_india_launch_date.pdf
    • https://s3.amazonaws.com/pavujiniz/2016_harley_davidson_touring_model_service_manual.pdf
    • https://s3.amazonaws.com/widuxade/how_much_does_lotus_car_cost.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.