PDF malware analysis — malicious · e2d4443c7d9f1170

MALICIOUS

PDF

58.3 KB Created: 2021-04-24 06:36:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22

MD5: ab71e9ff88c56cf5f76ad481cb0fabb9 SHA-1: fb8917c9bcbed4552a93e3cff0147b6d1806dbc2 SHA-256: e2d4443c7d9f11706f09d5a07bfe8e4a3f323bcfc0742c2fce849ac33d1299b3

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains numerous embedded URLs, many of which point to disposable hosting and are part of a link farm, indicating a malicious intent to redirect users. The ClamAV detection and ML classifier further support its malicious nature. The document body, though heavily obfuscated, appears to be a lure related to song lyrics, likely to trick users into clicking the malicious links.

Machine Learning

Nyx PDF Classifier malicious score 0.7345

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/strik?utm_term=have+yourself+a+merry+little+christmas+lyrics+sheet+music+pdf PDF link annotation
- http://gudutisiluzew.mypressonline.com/cardiovascular_system_examination.pdfIn PDF document text
- http://vienvozvrat.site/best_stocks_to_buy_for_beginnerstotdl.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470703/normal_6050cbecc1ee7.pdfIn PDF document text
- http://eeuuurrrrr.space/braun_thermoscan_irt6520b_7sjc7y.pdfIn PDF document text
- http://torchland.xyz/gamasitifixuvozifoduzzh9gh.pdfIn PDF document text
- http://umniashka.ru/cloud_computing_architecture04rky.pdfIn PDF document text
- http://mufinofol.scienceontheweb.net/daxatolafasorasokujur.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365620/normal_601cadbba4d06.pdfIn PDF document text
- http://xegazinijitup.mywebcommunity.org/dapapivemasimaxazakadaven.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403418/normal_6065424227392.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4464734/normal_60604e16b9be8.pdfIn PDF document text
- http://inglassrus.ru/can_you_get_sweat_app_on_tvrq8gg.pdfIn PDF document text
- http://idealica-italy.site/bed_sheets_suppliers_in_pakistanyeosh.pdfIn PDF document text
- http://odebayitrafikhizmeti.com/deck_the_halls_piano_sheet_music1yklw.pdfIn PDF document text
- http://biomaniix.website/880030792366kvmu.pdfIn PDF document text
- http://zedowep.atwebpages.com/kalender_2020_baden_wrttemberg_feiertage.pdfIn PDF document text
- https://s3.amazonaws.com/tawosutosuxi/navigator_react_native_android.pdfIn PDF document text
- https://s3.amazonaws.com/winumigutam/how_to_load_paper_in_sharp_el-2630p.pdfIn PDF document text
- https://s3.amazonaws.com/juzewojavomofew/32620484976.pdfIn PDF document text
- https://s3.amazonaws.com/xelimewat/84516382252.pdfIn PDF document text
- https://s3.amazonaws.com/wazotojemov/41241846810.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.