Malicious PDF — malware analysis report

Static analysis result for SHA-256 df1e79d103cc76b2…

MALICIOUS

PDF

58.6 KB Created: 2021-03-29 03:13:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90b284dbf8830ec5ce21e1fb518261a1 SHA-1: f96eccd735ee13bae6657b512f0343a0e8540eb5 SHA-256: df1e79d103cc76b20d5746def10c4a8dd702bba2f8d56d2b9bd3d44e07ed428f
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was identified as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs pointing to disposable domains and link farms, suggesting a phishing or malware distribution scheme. The PDF structure and embedded links are consistent with techniques used to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9410

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=although+despite+rephrasing+pdf
    • https://cdn.sqhk.co/diwiporeb/lxSjcsZ/the_sims_mobile_cheat_codes_ios.pdf
    • https://cdn.sqhk.co/sifolilo/sOicVjg/wofizoxowobenolabenatanim.pdf
    • https://cdn-cms.f-static.net/uploads/4420765/normal_605efdd25ee91.pdf
    • https://serekarivevug.weebly.com/uploads/1/3/1/4/131407867/votoles.pdf
    • https://kutenamig.weebly.com/uploads/1/3/0/7/130740069/sozumilazewosiwas.pdf
    • http://puzexijabin.mypressonline.com/english_to_afrikaans_dictionary_download_free.pdf
    • https://boxatikavizag.weebly.com/uploads/1/3/4/6/134680825/986594.pdf
    • http://nemugub.mywebcommunity.org/gozenuzuxinav.pdf
    • https://cdn.sqhk.co/momogajopi/jcvge3j/hymn_of_praise_and_thanksgiving_to_god.pdf
    • https://zemutixo.weebly.com/uploads/1/3/4/8/134865820/guves_zusifepomolen.pdf
    • https://cdn-cms.f-static.net/uploads/4370762/normal_60307229168d7.pdf
    • http://kevebofuru.medianewsonline.com/acta_de_nacimiento_sinaloa.pdf
    • https://cdn-cms.f-static.net/uploads/4376879/normal_602c219a4359a.pdf
    • https://nenilinuda.weebly.com/uploads/1/3/1/3/131383514/d1892019ef9b7f.pdf
    • http://paruxezogu.mygamesonline.org/filum_rotifera.pdf
    • https://cdn.sqhk.co/mowasikuso/iaJjioW/bluestacks_apk_installation_failed_older_sdk.pdf
    • http://bidetoluji.getenjoyment.net/legend_of_zelda_ocarina_of_time_music_notes.pdf
    • https://s3.amazonaws.com/folexapurilowe/fivogesafivuvemupoweloteg.pdf
    • https://s3.amazonaws.com/xebuvuwov/20170827480.pdf
    • https://s3.amazonaws.com/wakuzidi/goldman_sachs_equity_research_report.pdf
    • https://s3.amazonaws.com/kavalukato/jevisu.pdf
    • http://newepizudef.atwebpages.com/kuvutisufe.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.