Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1d1e0702ca725a5…

MALICIOUS

PDF

50.6 KB Created: 2021-03-21 01:49:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 86d383a4b3ece389832ea5ab990cca6e SHA-1: bc60088af21fb735dd8c4eab0acc0af42b4f9e07 SHA-256: e1d1e0702ca725a51a8d13838ca426cde5efef4a548df85c54085050503223d9
164 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, including a high-severity rule indicating suspicious links and a link farm on disposable hosting. The embedded URLs point to domains associated with phishing or malware distribution. The ClamAV detection confirms its malicious nature, identifying it as Pdf.Phishing.Trojan. The presence of multiple external URIs suggests an attempt to redirect the user to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6307

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/aws?utm_term=dixie+chopper+customer+service PDF link annotation
    • http://fiwetud.scienceontheweb.net/giberokujejiroza.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382973/normal_5fe2ca2657092.pdfIn PDF document text
    • https://besuxape.weebly.com/uploads/1/3/4/3/134374749/tinovubomu.pdfIn PDF document text
    • http://gejejasofubi.mywebcommunity.org/city_of_endless_night.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369506/normal_603fc1e862838.pdfIn PDF document text
    • http://vadanunagirira.getenjoyment.net/reaccion_acneiforme_tratamiento.pdfIn PDF document text
    • http://rastet-malysh.ru/tezanesebejaxudifomak69.pdfIn PDF document text
    • https://cdn.sqhk.co/wuwoxegolewa/YQijXih/among_us_free_play_online_now.pdfIn PDF document text
    • http://ig-supportcenter.xyz/giardia_treatment_guidelinesbqhv2.pdfIn PDF document text
    • https://cdn.sqhk.co/xikokopek/fPdhiWX/tenuku.pdfIn PDF document text
    • https://cdn.sqhk.co/gasalikuviz/7HNgjSr/california_weed_farms_jobs.pdfIn PDF document text
    • http://lamaded.mywebcommunity.org/rumakepajekof.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457298/normal_5ff513aad43d9.pdfIn PDF document text
    • http://arfesopt.com/how_to_run_a_tig_weldernvnkw.pdfIn PDF document text
    • http://shoop-fm.ru/wirewivudujf6k8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449183/normal_6041a4e76be58.pdfIn PDF document text
    • https://sejixegagetuta.weebly.com/uploads/1/3/0/9/130969850/bafadis_keseg_tomudelabebawi.pdfIn PDF document text
    • http://datab.vip/tidikofv8no.pdfIn PDF document text
    • https://cdn.sqhk.co/gaxudofexal/O3hh2hj/merriam_webster_vocabulary_builder_file_type.pdfIn PDF document text
    • https://cdn.sqhk.co/jerowerar/brhbHgj/pidotanotefur.pdfIn PDF document text
    • http://leporabev.mywebcommunity.org/xedumalozomevatutobad.pdfIn PDF document text
    • https://xalemutaxites.weebly.com/uploads/1/3/0/9/130969461/6329617.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a31741d-e0b7-4c22-bf97-424a5a168c39/gk_chesterton_orthodoxy_study_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f00f879b-e8e2-487b-a7d3-e015843a9010/luvuvutizoduzaruk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/825b1687-4eb6-4ad7-bc9c-d11ab4acc0a0/maths_puzzles_and_riddles_for_class_6_with_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/695e3678-4dd7-45fb-a8f6-bb289701ae90/tilevitojawam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/902e108b-accf-407d-9fb9-14144aeb4d24/dish_network_internet_speeds_and_prices.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.