Malicious PDF — malware analysis report

Static analysis result for SHA-256 e130d8b41ffb84e2…

MALICIOUS

PDF

62.7 KB Created: 2021-03-23 09:58:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 7b079c67f33dfa1da629c7fdccb68b4f SHA-1: 925c1a06e808075ae60cebc4059c1a5f054ae52d SHA-256: e130d8b41ffb84e2ca841249571031fae3f356e30684c2c840fa68f85a2b3276
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, many hosted on disposable domains, indicating it functions as a link farm. This is strongly suggestive of a phishing or malware distribution campaign. The ML classifier and ClamAV detection further support its malicious nature, likely exploiting PDF vulnerabilities to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9000

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=apologetics+ravi+zacharias+pdf PDF link annotation
    • https://cdn.sqhk.co/novupezezis/iesyshe/american_pastoral.pdfIn PDF document text
    • https://cdn.sqhk.co/zevolazezag/jhLgcie/13644866939.pdfIn PDF document text
    • https://cdn.sqhk.co/fugovigul/ieI3ha0/83821036140.pdfIn PDF document text
    • http://vnds-super.space/xorobc8n5g.pdfIn PDF document text
    • https://romuxejis.weebly.com/uploads/1/3/4/8/134887308/2353398.pdfIn PDF document text
    • https://cdn.sqhk.co/gadakoferupa/c6ARwXQ/85401741841.pdfIn PDF document text
    • http://kernig.store/puseniruxifuzuzilpg87z.pdfIn PDF document text
    • http://proba7.xyz/percy_jackson_the_lightning_thief_book_plotybr9r.pdfIn PDF document text
    • https://bibatajikoxego.weebly.com/uploads/1/3/5/3/135315017/594f0.pdfIn PDF document text
    • https://cdn.sqhk.co/kojanakif/jggCxBP/superhero_light_robot_rescue_speed_hero_games_online.pdfIn PDF document text
    • https://cdn.sqhk.co/talidapato/XSjhkQF/learning_upgrade_login.pdfIn PDF document text
    • https://cdn.sqhk.co/mirofifuba/rxe5Pgi/zaliwativazoxovox.pdfIn PDF document text
    • https://cdn.sqhk.co/lunexubafexo/jxgficL/lowosekovagotulus.pdfIn PDF document text
    • http://silver35.ru/antithrombin_3_deficiency_treatment_guidelineswdz69.pdfIn PDF document text
    • http://lovemecompletely.com/futiximowisufituri1la.pdfIn PDF document text
    • https://cdn.sqhk.co/risosejuze/dEphaTb/bamumokexaputuzewemolom.pdfIn PDF document text
    • https://wodaxudufusan.weebly.com/uploads/1/3/0/8/130814186/tevamoba-nimafobemuv-wumojupun-womewarom.pdfIn PDF document text
    • https://cdn.sqhk.co/nadipozow/hijggVw/meseximekibo.pdfIn PDF document text
    • https://cdn.sqhk.co/vufebevefo/jgXhiwB/8583745789.pdfIn PDF document text
    • http://setutekafud.epizy.com/zifubuxirobajided.pdfIn PDF document text
    • http://nodixuzotegiv.rf.gd/jujopokexitegesikowinato.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.