PDF malware analysis — malicious · e65ccb1f6564f636

MALICIOUS

PDF

52.9 KB Created: 2021-03-28 06:36:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c04f681ac0dfa15bdd88ba2f2013f827 SHA-1: fc21831283a339fb217745d5f105639a39b7153b SHA-256: e65ccb1f6564f636844d0be77e863772d2267adcdb87432fe80bc1bc22b3ffa5

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing lure. It contains numerous external links, with a primary suspicious URL pointing to fokemale.ru, suggesting an attempt to redirect the user to a malicious site. The document's structure, being image-heavy with minimal text, further supports its use as a deceptive tactic.

Machine Learning

Nyx PDF Classifier malicious score 0.8580

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 52 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fokemale.ru/award?keyword=statistical+methods+freund+solutions+pdf
- https://muwalivom.weebly.com/uploads/1/3/2/6/132695892/lawapuxe.pdf
- https://sujujawajiz.weebly.com/uploads/1/3/5/9/135964945/885654694b275.pdf
- https://rujuramokukavet.weebly.com/uploads/1/3/0/7/130739146/9697c4.pdf
- http://monongzhlh.space/normal_air_fuel_ratio_at_idleo46d0.pdf
- http://arnautmebel.ru/framed_ink5kepw.pdf
- https://kexulisil.weebly.com/uploads/1/3/4/7/134762119/kizeguguno.pdf
- https://s3.amazonaws.com/pipaneku/because_you_loved_me_video_free.pdf
- https://uploads.strikinglycdn.com/files/351a8637-d837-432c-b7ec-35792124c1f8/what_is_the_subset_of_3_4.pdf
- https://uploads.strikinglycdn.com/files/1dbcba15-2195-4bd4-84fe-3b1827da7f33/fawenogelan.pdf
- https://s3.amazonaws.com/ximupuv/subphylum_chelicerata.pdf
- https://s3.amazonaws.com/satuja/8393335103.pdf
- https://uploads.strikinglycdn.com/files/f4a7707d-cdde-422b-9885-3b7f1d3b1a63/71248004721.pdf
- https://s3.amazonaws.com/kaxukok/35578513883.pdf
- https://s3.amazonaws.com/padosumifubobo/manual_vs_automatic_transmission_fuel_efficiency.pdf
- https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_8d633d675a99415395260a69bffa8876.pdf?index=true
- https://054d5c26-596f-48a3-87a7-0fc79031e5db.filesusr.com/ugd/599026_7ee49f306345496da38ec29b45500276.pdf?index=true
- https://s3.amazonaws.com/jitimesolagun/how_is_lattice_energy_calculation_born_haber_cycle.pdf
- https://uploads.strikinglycdn.com/files/6868d3a4-90a1-451a-8196-ecc2313dc86c/venoxoviwif.pdf
- https://8641c524-1fb5-4292-87ed-dd72f64d6c22.filesusr.com/ugd/9b7d8a_a38ecf418360404ca5850347e17ccd21.pdf?index=true

Open this report in the interactive analyzer, or submit your own file for analysis.