PDF malware analysis — malicious · f7fc8aba1245d274

MALICIOUS

PDF

51.7 KB Created: 2021-03-16 18:13:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 35c68b94eea5f6d7cdcf73c6a662d243 SHA-1: 8a1f4d756f6a23b1ae93ff2d2ae9a015f2c2e775 SHA-256: f7fc8aba1245d274c534224530eb3c01defa65fa6e5cfea1b76eefe640d617c8

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF is identified as a phishing lure due to its image-only nature and embedded external links, a common tactic to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external PDF links, suggesting an attempt to distribute or host further malicious content. The ML classifier and ClamAV detection strongly support its malicious classification.

Machine Learning

Nyx PDF Classifier malicious score 0.9372

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 51 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dugedepap.ru/award?keyword=arrl+frequency+chart+pdf
- https://cdn.sqhk.co/legezuseg/hjiyBge/97334011690.pdf
- https://static.s123-cdn-static.com/uploads/4420767/normal_5ffe6cf6cda74.pdf
- https://cdn.sqhk.co/vasegodesazu/2aegeha/47990364007.pdf
- https://static.s123-cdn-static.com/uploads/4496810/normal_5fc5c990235f0.pdf
- https://static.s123-cdn-static.com/uploads/4496826/normal_5ff563dba05e9.pdf
- https://riwusivi.weebly.com/uploads/1/3/4/9/134900433/dadaranefebatopule.pdf
- https://cdn-cms.f-static.net/uploads/4497646/normal_5fe6322bcea52.pdf
- https://cdn-cms.f-static.net/uploads/4490121/normal_604a4954b3cff.pdf
- https://cdn.sqhk.co/figakeves/iaMjhCK/mens_hairstyles_braids.pdf
- https://cdn.sqhk.co/mekizojo/jPghz8Z/52070761391.pdf
- https://pudakivofuleges.weebly.com/uploads/1/3/4/8/134853743/9db8cf18ecf.pdf
- https://cdn.sqhk.co/juvebuzizej/oWIrL2B/76111516223.pdf
- https://sogatetemurus.weebly.com/uploads/1/3/4/3/134379625/8013129.pdf
- https://pidowiwosuzaji.weebly.com/uploads/1/3/0/9/130969191/bc02ea.pdf
- https://b86313a8-447b-404d-ae6d-bc69740d899e.filesusr.com/ugd/e54fc7_1388e0e53a2643c28d27d2cef6ae0a2b.pdf?index=true
- https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_36523ce51fd04a8aa449d405981e03c5.pdf?index=true
- https://ac3db616-04cb-40f1-8357-c67041f5e20c.filesusr.com/ugd/eda9ba_9d4a3ec4bdf048c0bdd5f85995deeea8.pdf?index=true
- https://e29f0852-aa8c-4fc4-a5db-fcd144ab7086.filesusr.com/ugd/b730be_6bc882ae4eaa47e59c7e284b9e491cd0.pdf?index=true
- https://3857ddc0-2b33-46ba-b4a8-ebef9b167687.filesusr.com/ugd/5cc0d5_9d804e7c9674420ba8164fdf3f862668.pdf?index=true
- https://d6d3a1c5-32ce-46e9-ae92-c5b8d84d65d9.filesusr.com/ugd/a3b54b_3b011a1f21044b60a5c7c99ae148cf25.pdf?index=true
- https://e6676b24-921d-4f57-8fca-beda98688f3c.filesusr.com/ugd/144d27_d4fad88c23834566a760fcb45546c1db.pdf?index=true

Open this report in the interactive analyzer, or submit your own file for analysis.