Malicious PDF — malware analysis report

Static analysis result for SHA-256 df5b18154a6bb86e…

MALICIOUS

PDF

56.7 KB Created: 2021-04-30 07:44:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d94e5a12aa60266e3119871cc04e31fd SHA-1: e06645b7793f4894f356d7e89873d9f08cbcf3b8 SHA-256: df5b18154a6bb86e3a929b10637a50470c3f9f5438910c0b3b3c334da3cecfb6
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a malicious phishing lure due to its structure, containing a single image and minimal text, typical of a screenshot designed to obscure clickable elements. It contains numerous external links, including one that appears to be a phishing URL. The ClamAV detection and ML classifier further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6700

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 56 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=what+is+clerical+aptitude+test
    • http://zugasanuko.getenjoyment.net/18448964189.pdf
    • https://bemazoveber.weebly.com/uploads/1/3/4/5/134512295/momonowonamebalobupa.pdf
    • http://sazinoz.mypressonline.com/lefevowivig.pdf
    • https://jokasagumejede.weebly.com/uploads/1/3/1/0/131070006/konunar_mowanukeli.pdf
    • http://levantemosaic.com/can_you_do_multiple_words_in_scrabblei1mcq.pdf
    • https://xekelubapakam.weebly.com/uploads/1/3/4/4/134499273/6731457.pdf
    • http://mscredit.info/how_do_organisms_depend_on_each_other_in_an_ecosystemqvul9.pdf
    • https://xuwekakef.weebly.com/uploads/1/3/1/8/131856316/kagaxovemakag-vavegixajugapi.pdf
    • http://kapusta.pro/how_to_measure_blood_pressure_using_omronh1169.pdf
    • https://navolujute.weebly.com/uploads/1/3/1/4/131483334/6353333.pdf
    • https://uploads.strikinglycdn.com/files/03e7593f-6a53-4749-9654-6b3e8265f1af/goveruzaxusavotef.pdf
    • https://uploads.strikinglycdn.com/files/f5ee3a2d-13fe-4fa5-98c2-2f94ba75a4e8/vawedezisizezese.pdf
    • https://uploads.strikinglycdn.com/files/723bc97b-f0f7-47b2-927d-26eb6fee0848/how_to_use_my_little_steamer_mini.pdf
    • https://uploads.strikinglycdn.com/files/b4f8185c-40e2-4356-ba7f-8a8f2f51223a/how_to_connect_jaybird_freedom.pdf
    • https://uploads.strikinglycdn.com/files/f99cf6ab-ea13-463d-94a3-8566a0ab134b/dajeneniwuxijadebojet.pdf
    • https://uploads.strikinglycdn.com/files/34f4d7d0-5d8c-4b5a-ab6e-c1f0422e52bc/soft_serve_ice_cream_machine_for_sale_in_johannesburg.pdf
    • https://uploads.strikinglycdn.com/files/34bde77c-1b38-46c4-a424-8295a9689e0b/22335363129.pdf
    • https://uploads.strikinglycdn.com/files/99ebf317-b22b-48a3-8edc-d684d3042f82/buxofivovukezovu.pdf
    • https://uploads.strikinglycdn.com/files/78e15b97-af66-423a-b98b-a5278d058c7a/94178768090.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.