PDF malware analysis — malicious · fd02ab3846a61a81

MALICIOUS

PDF

43.5 KB Created: 2021-02-27 01:24:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: 611680586a43140607bb371c3b3d651a SHA-1: d33912fadb27467371d5adf3756d2ea86b21e6ed SHA-256: fd02ab3846a61a81f2e9d5c58d0d2308c33f87e770546019ffd9ebc928fa9807

174 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF is identified as a phishing lure due to its image-heavy nature and minimal text, typical of a screenshot masquerading as a clickable element. It contains a mass external PDF link farm, with multiple URLs pointing to potentially malicious or SEO-manipulated content. The ClamAV detection and ML classifier further support its malicious classification.

Machine Learning

Nyx PDF Classifier malicious score 0.8720

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 2 text block(s), carries a click-outward action, and is only 43 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dugedepap.ru/award?keyword=why+is+it+important+to+learn+how+to+write+reports PDF link annotation
- http://dedarijaluwonu.22web.org/xupoputidekazodiwuxu.pdfIn PDF document text
- https://tejukikefuxod.weebly.com/uploads/1/3/4/7/134703803/5676473.pdfIn PDF document text
- https://bivibonade.weebly.com/uploads/1/3/4/0/134041173/paravegoribono.pdfIn PDF document text
- https://duvozeja.weebly.com/uploads/1/3/0/7/130739152/sofasoguf_kasapu_wajenul.pdfIn PDF document text
- https://fufifodex.weebly.com/uploads/1/3/2/8/132814348/b968f67f.pdfIn PDF document text
- https://wokulenazaxur.weebly.com/uploads/1/3/4/7/134744474/borudogiguz_gagexufike_waloxilokix_jubamabeketuwi.pdfIn PDF document text
- https://pawudovavumub.weebly.com/uploads/1/3/1/4/131411600/jifexopuxi.pdfIn PDF document text
- https://bolamowoxuwev.weebly.com/uploads/1/3/3/9/133997192/60837d477.pdfIn PDF document text
- https://s3.amazonaws.com/supefujoxopubu/avery_template_5366_online.pdfIn PDF document text
- https://s3.amazonaws.com/mavixu/87679887718.pdfIn PDF document text
- https://s3.amazonaws.com/xasovewipeje/ronutemokuxewekanozofefe.pdfIn PDF document text
- https://s3.amazonaws.com/fukepez/chatal_band_pagalworld.pdfIn PDF document text
- https://s3.amazonaws.com/marimejerebo/kamikinivizujufejaral.pdfIn PDF document text
- https://s3.amazonaws.com/zijivevip/56456589082.pdfIn PDF document text
- https://s3.amazonaws.com/waxapoz/kunuxotu.pdfIn PDF document text
- https://s3.amazonaws.com/remavuj/xilojib.pdfIn PDF document text
- https://s3.amazonaws.com/likerajatob/anbe_anbe_kollathey_song_masstamilan.pdfIn PDF document text
- http://femubixipo.rf.gd/68095891379.pdfIn PDF document text
- https://s3.amazonaws.com/kewakuko/les_miserables_movie_2019_ending_explained.pdfIn PDF document text
- https://s3.amazonaws.com/zonivezada/andreas_moritz_carti.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.