PDF malware analysis — malicious · f15a7139ca056c49

MALICIOUS

PDF

49.8 KB Created: 2021-09-09 22:43:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: 1ca70aaae4f8e1252fdc636b772ba3a6 SHA-1: 9876979cb76358a78ba366fb0ff05aec3a3fc740 SHA-256: f15a7139ca056c49b918a03ad95820b05d81df99302ca2136c6c5a11be1ec9fd

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs pointing to external websites, many of which are hosted on disposable domains and appear to be part of a link farm. The ClamAV detection and ML classifier strongly indicate malicious intent, likely for phishing or distributing further malware. The presence of PDF_URI and PDF_SEO_DISPOSABLE_LINK_FARM heuristics further supports this assessment.

Machine Learning

Nyx PDF Classifier malicious score 0.6843

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://queure.ru/uplcv?utm_term=1111+cloudflare+apk PDF link annotation
- http://studioboscono.it/userfiles/files/lesavaxebefulutoturo.pdfIn PDF document text
- http://erainbowrealty.com/userfiles/file/busuluvapin.pdfIn PDF document text
- http://efuegypt.org/userfiles/file/mabilididaji.pdfIn PDF document text
- http://glampingcaravan.com/userfiles/file/20210907030624.pdfIn PDF document text
- http://s8radziejowice-paszkow.pl/userfiles/file/19197879204.pdfIn PDF document text
- https://chowdhurytourism.com/ckfinder/userfiles/files/tulufubudoxigetuje.pdfIn PDF document text
- http://mdbim.pl/ubezpiecz/obrazy/file/56630306423.pdfIn PDF document text
- https://socardan.com/userfiles/files/wutebewefuj.pdfIn PDF document text
- https://ofcourselc.com/admin/uploadsfile/2892971549.pdfIn PDF document text
- https://homestayhoian.vn/uploads/image/files/7006424085.pdfIn PDF document text
- http://eptesteplelek.com/uploads/file/63997311446.pdfIn PDF document text
- http://xn----8sbfhu6ab4bqv.xn--p1ai/userfiles/file/82732680919.pdfIn PDF document text
- https://sowlindia.com/userfiles/file/29524482206.pdfIn PDF document text
- http://otestmanager.org/club/data/userfiles/file/20210903090508.pdfIn PDF document text
- https://anna-bel.com/app/webroot/files/userfiles/files/91191091668.pdfIn PDF document text
- http://www.birapart.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132b482f364c---perazutizalukegibijus.pdfIn PDF document text
- https://liur-krd.ru/userfiles/file/85057763189.pdfIn PDF document text
- http://www.lnk-creation.fr/upload/file/32272129922.pdfIn PDF document text
- https://middletonchambers.com/ckfinder/userfiles/files/levedenuzezifa.pdfIn PDF document text
- http://ozdoby-betonowe21.pl/Upload/file/naxoramepaxokawizegomi.pdfIn PDF document text
- https://a1-recruitment.fr/v2011/Files/fck_upload/file/gudowobixebimejifaxomat.pdfIn PDF document text
- https://preciseenergygroup.com/media/desivipozuw.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.