Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed4d565e3408393c…

MALICIOUS

PDF

49.6 KB Created: 2020-11-13 20:30:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 09345eee5f1b3bb9ee5a7e4471636246 SHA-1: 7f40e1161637aa7f925da8e13035c41b8169bd1c SHA-256: ed4d565e3408393c52d5bdf5db4d7240dac1d6be3b3a5fe865bf5d1a8b3d7687
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of external links, many pointing to S3 buckets and other domains, suggesting a link farm or SEO manipulation tactic. ClamAV and ML heuristics also flagged the file as malicious, with ClamAV identifying it as a phishing trojan. The presence of embedded URLs and the PDF structure strongly indicate an attempt to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7011

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=online+horse+games+like+star+stable PDF link annotation
    • https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/vunud.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368242/normal_5f8897f3268e2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369336/normal_5f9b5957cdb35.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379615/normal_5f970f822b392.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375522/normal_5f9db6812ad0f.pdfIn PDF document text
    • https://kurikezexiwu.weebly.com/uploads/1/3/0/7/130775092/lebelenufe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424027/normal_5fa1787abb41d.pdfIn PDF document text
    • https://s3.amazonaws.com/lupebesu/d_d_5e_conversion_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/ratixifo/lymphangitic_carcinomatosis.pdfIn PDF document text
    • https://s3.amazonaws.com/vitelitubovuluj/calligraphy_art_app_android.pdfIn PDF document text
    • https://s3.amazonaws.com/leguvefu/malayalam_calendar_2019_free_download_deepika.pdfIn PDF document text
    • https://s3.amazonaws.com/fosawef/92030436869.pdfIn PDF document text
    • https://s3.amazonaws.com/zasepo/tsum_tsum_experience.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.