PDF malware analysis — malicious · 01055d3b12292bf7

MALICIOUS

PDF

68.0 KB Created: 2021-06-06 10:49:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 304d3a31d851b0b93e485e6a39475a26 SHA-1: 3f8816e54a5ed0c1388a227aee4b519f15a4bcb1 SHA-256: 01055d3b12292bf79ea40a732423d6ac44ca3a6ca6735afedf762b742699ee34

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to potentially malicious or SEO-spam related domains. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting an attempt to drive traffic or distribute further payloads. The ClamAV detection and ML classifier further support its malicious nature, likely as a phishing or malware delivery vehicle.

Machine Learning

Nyx PDF Classifier malicious score 0.9145

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://huntic.ru/pbw?utm_term=hipertansiyon+hasta+bak%25C4%25B1m+plan%25C4%25B1+%25C3%25B6rne%25C4%259Fi
- https://cdn-cms.f-static.net/uploads/4409998/normal_60602d37bcbaf.pdf
- https://mebiwabubeneven.weebly.com/uploads/1/3/1/8/131871414/satosetivirujixaba.pdf
- https://boluduviwusasuv.weebly.com/uploads/1/3/4/4/134458391/voneravulorirabivoto.pdf
- https://zajolapa.weebly.com/uploads/1/3/0/7/130776493/komuf.pdf
- https://static.s123-cdn-static.com/uploads/4417413/normal_60070c8d01e56.pdf
- https://cdn-cms.f-static.net/uploads/4391954/normal_605f57fc839a7.pdf
- https://static.s123-cdn-static.com/uploads/4405904/normal_5fe39622361de.pdf
- https://lirupije.weebly.com/uploads/1/3/1/6/131606624/8c1752e.pdf
- https://wejafivikime.weebly.com/uploads/1/3/0/9/130969279/nakiwoxudadetididap.pdf
- https://static.s123-cdn-static.com/uploads/4467038/normal_5fc94720a3f25.pdf
- https://static.s123-cdn-static-d.com/uploads/4501486/normal_60b26fd5940bf.pdf
- https://xobojurum.weebly.com/uploads/1/3/4/5/134599739/turuf.pdf
- https://cdn-cms.f-static.net/uploads/4376371/normal_5fe8f151f1a19.pdf
- https://kowulenube.weebly.com/uploads/1/3/2/7/132740682/9256553.pdf
- https://gimeboxevamovuv.weebly.com/uploads/1/3/4/4/134494840/4f2a418c1f3.pdf
- https://potemoguzoka.weebly.com/uploads/1/3/4/6/134646314/5eddb3036.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/a9b5fad0-f2ad-4c58-80f6-5931b3bd4f88/classical_guitar_lessons_medford.pdf
- https://uploads.strikinglycdn.com/files/c309f519-2e55-414d-8a47-b8c695f5705d/who_was_known_as_the_most_catholic_king.pdf
- https://uploads.strikinglycdn.com/files/d0f7ecce-0cd5-48ed-ac8b-e83c388be9c1/algebra_structure_and_method_book_1_chapter_1.pdf
- https://uploads.strikinglycdn.com/files/4590b6fb-6ddf-43bd-8df9-ef114d7aa4f9/gekizakuli.pdf
- https://uploads.strikinglycdn.com/files/2415982a-70ae-4668-831e-4412d4ee52ea/how_to_install_badland_3500_winch_on_flatbed_trailer.pdf
- https://uploads.strikinglycdn.com/files/7b3869f2-d1a7-4b71-b14d-84ee37072cbc/xetafekikirofo.pdf
- https://uploads.strikinglycdn.com/files/5396bfb9-6499-409e-b6ff-796055d954df/four_safety_rules.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000db61.bin` `f17d3566517cd20b89c0a7d27a70069f78a6612dff02da139901d2fa04e7bcc9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDB61	5724 bytes
`font_01_sfnt_off0000ee77.bin` `4bb9ae36a1f8c3fab75c4ff385370a86b9cf3c14151c9c6c130796812abf342a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEE77	10996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.