Malicious PDF — malware analysis report

Static analysis result for SHA-256 e05a3827ec2152fa…

MALICIOUS

PDF

84.6 KB Created: 2021-01-12 14:21:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: 4371342e7881de50208012f1e17901ed SHA-1: c59aa91f6fee3fdcb696f11dac8cda3f0c4b1cba SHA-256: e05a3827ec2152fa741b7cb7a3685224813517a99c8eb34e2ed9ca77efb30754
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded links, with one specifically pointing to known malicious redirector infrastructure. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' and the ClamAV detection 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0' strongly indicate a phishing or malware distribution attempt. The presence of numerous external PDF links also suggests a link farm, a common tactic for SEO poisoning or distributing malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=centre+europ%25C3%25A9en+de+formation+avis+2018 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4367275/normal_5f8f279088a47.pdfIn PDF document text
    • https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/gosibokuvefuj.pdfIn PDF document text
    • https://jimivisimobud.weebly.com/uploads/1/3/4/9/134901817/tixezapud.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368772/normal_5f93ed6ba4669.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450430/normal_5fd977dbc66bf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421213/normal_5fa4f98b81921.pdfIn PDF document text
    • https://lezotaxodad.weebly.com/uploads/1/3/4/4/134432483/sewupozemefub_budafimetokoga_matepakamibodum.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445101/normal_5fb8e8f3af543.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367296/normal_5f88ae63efae0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382406/normal_5fa3dcc8172a9.pdfIn PDF document text
    • https://site-1196011.mozfiles.com/files/1196011/field_hockey_defense_tips_videos.pdfIn PDF document text
    • https://s3.amazonaws.com/nijosinizo/59251606405.pdfIn PDF document text
    • https://s3.amazonaws.com/guvovigo/singular_and_plural_pronouns_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/nuselufuzo/29360872358.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.