PDF malware analysis — malicious · 293e7a8dd73b402e

MALICIOUS

PDF

69.5 KB Created: 2021-04-01 20:48:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 006111017d981fca8bbab698fb0cf833 SHA-1: 93687d54310524b4e2b7d8365b6b81d4c7a75bb5 SHA-256: 293e7a8dd73b402e5b6118c3b1bbe0ea60fe7b23561c533392e51ce3da52279e

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-optimized, suggesting a link farm or phishing attempt. One prominent external URI points to a suspicious domain, jottigo.ru, which is likely part of a phishing campaign. The ClamAV detection and ML classifier also indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.8212

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/award?keyword=projeto+alimenta%25C3%25A7%25C3%25A3o+saud%25C3%25A1vel+ensino+fundamental+pdf
- https://cdn.sqhk.co/libegavezu/himifRn/rise_of_civilization_lancelot_talent_guide.pdf
- https://nepuvojikonutoz.weebly.com/uploads/1/3/4/6/134677469/rotasosexaj.pdf
- https://cdn.sqhk.co/josipinu/ckVFJEd/sacred_sword_princess_mod.pdf
- https://dikubudekoguzo.weebly.com/uploads/1/3/1/8/131857294/cb4e8b5c8.pdf
- https://xoregofejaba.weebly.com/uploads/1/3/4/6/134651656/7ad6f80bedd879f.pdf
- https://cdn.sqhk.co/mugolino/hdjegiR/zinalatajenukitisomuxi.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/xunilukegez/best_budget_performance_cars_2019.pdf
- https://99516632-72ce-40f3-a9a1-a01c91361c65.filesusr.com/ugd/e42c35_81487b59fb0744479136c92a749c4427.pdf?index=true
- https://s3.amazonaws.com/kovozenamofox/74626975731.pdf
- https://fb3efafe-1b0e-41a1-9434-8bf556110c4a.filesusr.com/ugd/de5e41_cb541400232a44919dce59611f59ce4a.pdf?index=true
- https://s3.amazonaws.com/lewuli/storyboard_template_for_elearning_course.pdf
- https://b54663a3-ff9d-4122-b75c-69b71428c9b0.filesusr.com/ugd/cfa91a_6013e10d143a4472b01fbd590996aa32.pdf?index=true
- https://s3.amazonaws.com/nuxepiduded/17991434038.pdf
- https://s3.amazonaws.com/zodererezuzuxi/92041601040.pdf
- https://s3.amazonaws.com/pajeriramal/42585241541.pdf
- https://s3.amazonaws.com/xulepiwa/sovexijilikabokosomobafuz.pdf
- https://f4e740b0-69d0-4d5c-a0c7-362dc6b2ad6d.filesusr.com/ugd/0356fc_15a91c4fee8142cb822891bfbd8b5175.pdf?index=true
- https://s3.amazonaws.com/fizufapu/dimikini.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f4e1.bin` `280f999a93bd492f1a4ea92c3cae1deaa5c1175915e41e2fbc4759a20fb343c9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF4E1	6056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.