Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff54e39caec08497…

MALICIOUS

PDF

49.6 KB Created: 2021-03-20 23:46:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 04a03aa385c6a2d6c964f55f43258d31 SHA-1: 099f22fd0c0c1bdc83126fb7416a8665373c45e9 SHA-256: ff54e39caec08497ee187b02a7fdcaf3bfe0ceb74a67f04804ce90d8bfd2ce18
232 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF is designed as a phishing lure, presenting a screenshot to entice users to click a malicious link. This link redirects to a large collection of other PDFs, likely for SEO manipulation or to host further malicious content. ClamAV and ML classifiers also flagged this file as malicious, indicating a high likelihood of phishing or trojan activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7384

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 49 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/aws?utm_term=bissell+proheat+plus+full-size+carpet+cleaner+17998
    • https://jukirabupunux.weebly.com/uploads/1/3/0/8/130874410/besegowon.pdf
    • https://static.s123-cdn-static.com/uploads/4387924/normal_5fc596931c93c.pdf
    • http://digitaltoolsfor.xyz/bijiganudowx1jy.pdf
    • https://cdn.sqhk.co/lawafopugu/eZkOBge/46805575706.pdf
    • https://cdn-cms.f-static.net/uploads/4392647/normal_5fd6582dbdd11.pdf
    • https://cdn-cms.f-static.net/uploads/4387571/normal_602d64990a95f.pdf
    • http://rabuvuz.22web.org/cayley_hamilton_theorem.pdf
    • https://cdn-cms.f-static.net/uploads/4376870/normal_5fe85be773f2a.pdf
    • https://cdn-cms.f-static.net/uploads/4447276/normal_5fd632de8ffd6.pdf
    • http://bofinaposo.iblogger.org/free_hershey_bar_wrapper_template_word.pdf
    • http://raxojomaman.iblogger.org/bomberman_fantasy_race_pc_free.pdf
    • https://cdn.sqhk.co/rivogigaweb/fhiOYif/fruit_cutter_game_app.pdf
    • https://cdn-cms.f-static.net/uploads/4500678/normal_6033a9715de94.pdf
    • https://cdn.sqhk.co/fovuxugo/q25icTV/amazon_alexa_black_friday_price.pdf
    • https://cdn.sqhk.co/kefaforuletu/eggdMhg/amharic_afaan_oromo_dictionary.pdf
    • http://women-ita.space/how_much_is_a_generac_22kw_generator2kpsd.pdf
    • https://static.s123-cdn-static.com/uploads/4449192/normal_5feb6f365804e.pdf
    • https://ninafaguri.weebly.com/uploads/1/3/4/5/134592808/fajitatavopivin.pdf
    • https://fezagigix.weebly.com/uploads/1/3/0/8/130813643/66af16bed00.pdf
    • http://xozodede.rf.gd/latest_android_4g_mobile_under_10000.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.