PDF malware analysis — malicious · f5d79502e1244e51

MALICIOUS

PDF

47.5 KB Created: 2020-12-01 17:18:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 33787b07acf8517b0a5769f3155da017 SHA-1: 61ab9d187f487bb327dfaaddd64a3fdb7bdb3e41 SHA-256: f5d79502e1244e51f73e74ce9c18e38ea29b2abf2368283b31d8c5a5f2996fed

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample is a PDF file identified as malicious by ClamAV and an ML classifier. It contains a significant number of external links, suggesting a link farm or phishing attempt. The primary URL, 'https://trafficel.ru/strik?utm_term=hot+water+bag+for+pain', appears to be part of a lure to direct users to potentially harmful content. No scripts were extracted, but the PDF structure itself facilitates the malicious activity.

Machine Learning

Nyx PDF Classifier malicious score 0.7569

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/strik?utm_term=hot+water+bag+for+pain
- https://cdn-cms.f-static.net/uploads/4375907/normal_5f8d9773b3de0.pdf
- https://tuwijojax.weebly.com/uploads/1/3/4/4/134477229/bajonudekov.pdf
- https://loxoxonejuk.weebly.com/uploads/1/3/4/6/134684666/bidabotine-jedoduxizurub-muxojupazo-legenewimejilud.pdf
- https://xavoxoxuda.weebly.com/uploads/1/3/1/3/131379246/5834768.pdf
- https://cdn-cms.f-static.net/uploads/4413238/normal_5f9f2f190cb1a.pdf
- https://wopegukozawemab.weebly.com/uploads/1/3/4/7/134727928/3ca8032.pdf
- https://texitanoz.weebly.com/uploads/1/3/0/7/130739996/taxisogo.pdf
- https://s3.amazonaws.com/rakabexozu/bariatric_surgery_guidelines_united_healthcare.pdf
- https://s3.amazonaws.com/gogonof/fivizamu.pdf
- https://s3.amazonaws.com/pazifetanegapu/1_goal_free_education_for_all.pdf
- https://s3.amazonaws.com/henghuili-files/lilidezev.pdf
- https://s3.amazonaws.com/jajoxulabojaso/sheryl_sandberg_lean_in.pdf
- https://s3.amazonaws.com/pidufozu/zikadufoviwololurisix.pdf
- https://s3.amazonaws.com/vikukinumet/jrotc_uniform_measurements.pdf
- https://s3.amazonaws.com/pazerogasarinu/level_32_on_40x_escape.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.