Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8dec9fc9a80e01d…

MALICIOUS

PDF

39.4 KB Created: 2021-04-05 23:43:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 85b6c2790ee4ef3f4c154437745a7990 SHA-1: 1f713207cc39598116c21774e79c23874c3e0a90 SHA-256: e8dec9fc9a80e01dd9cd3123c1214c2b2acf241e07887870d1bc001198bdc893
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by ClamAV and ML classifiers, exhibiting characteristics of a phishing lure. The heuristic PDF_IMAGE_LURE indicates it's an image-only document designed to trick users into clicking an embedded link, likely for credential harvesting or malware distribution. Multiple external URLs were extracted, suggesting a link farm or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7882

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 39 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=advanced+oxidation+processes+for+water+and+wastewater+treatment+pdf
    • https://cdn-cms.f-static.net/uploads/4502336/normal_603c4f740660e.pdf
    • https://cdn.sqhk.co/pupevadojas/Biex0jf/pututimigax.pdf
    • https://cdn-cms.f-static.net/uploads/4457848/normal_60602af79179c.pdf
    • https://static.s123-cdn-static.com/uploads/4426682/normal_60081c3615ac4.pdf
    • https://cdn.sqhk.co/vifejoneses/ggBgiVI/92270387627.pdf
    • http://salet.store/lg_not_cooling_eventsmouf.pdf
    • http://itfamily.pro/how_much_foster_parents_get_paid_in_nyubxny.pdf
    • https://cdn-cms.f-static.net/uploads/4464720/normal_603618b7a48a4.pdf
    • https://cdn.sqhk.co/xumirikebixo/uhbsqeD/choorian_full_movie_hd.pdf
    • https://static.s123-cdn-static.com/uploads/4476782/normal_5ffbce5d57beb.pdf
    • https://static.s123-cdn-static.com/uploads/4464530/normal_6006f321677b6.pdf
    • https://cdn.sqhk.co/zezinojox/gvhM8WD/pizixodarotatedizizopinas.pdf
    • https://cdn-cms.f-static.net/uploads/4448558/normal_600bdd924d075.pdf
    • http://kersita.fun/class_notes_templatecunst.pdf
    • https://cdn-cms.f-static.net/uploads/4489237/normal_60567b0194cfd.pdf
    • https://81d89a68-18ac-4cf1-ad00-ddd5d2f7da41.filesusr.com/ugd/ed58ef_7076f1bb7f8d4939ba3d0c7da456ef08.pdf?index=true
    • https://e3e1c2aa-7f41-47b0-8c2f-d823cb48b857.filesusr.com/ugd/7598fa_00ff34fdabbf444599b573418e18e5fb.pdf?index=true

Open this report in the interactive analyzer, or submit your own file for analysis.