PDF malware analysis — malicious · 298d537fd7614b7c

MALICIOUS

PDF

81.6 KB Created: 2021-04-28 23:52:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21

MD5: dedec40ea4cd5e34993dfadab0408b15 SHA-1: 87bacabffb89abf37aabc8f80db018e52d169a8c SHA-256: 298d537fd7614b7cc2c34d67c600ca2ff631d0f53597a9053eae82ae4568b054

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which point to disposable hosting and are likely part of a link farm designed to manipulate search engine results. One prominent URL, 'https://xezojetit.ru/strik?utm_term=how+much+is+a+singer+201k+worth', is embedded and likely serves as a lure for phishing or malware delivery. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.8998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xezojetit.ru/strik?utm_term=how+much+is+a+singer+201k+worth PDF link annotation
- http://idealslim-ordina.site/bobakebekiposoxibuzuwijuoq832.pdfIn PDF document text
- http://alexandreablog.com/area_of_a_triangle_worksheet_5th_grade8331c.pdfIn PDF document text
- http://50offstore.pro/romokahtccm.pdfIn PDF document text
- http://medicinfo.online/lowefomafafezikwfj4r.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/b9153e73-2a3b-4340-a551-230e4aa2c40f/seagate_goflex_home_password_recovery.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/85349692-92eb-4360-b4bb-0d6ee97aa434/30660580909.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3dea4b05-2d20-4070-bd68-9b65bf8672d5/what_is_the_latest_news_on_politics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/979e3ac3-d21e-463b-a9da-7495783f7ae9/ac_circuit_analysis_basics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/76a165e9-592a-4978-adfc-f3af2e939bfe/what_tv_channel_is_keep_it_country_on.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/62cd0080-efd3-4a61-8b8e-75c95d5d6274/80113224478.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d403c421-9b04-41cf-a831-7c3124229ed6/66383085161.pdfIn PDF document text
- https://34ec465e-51aa-4dba-9a8c-c05fcfb5ae84.filesusr.com/ugd/df15ee_0f6495ee1afa47968b9248d83bd35cd2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/9b326ee3-64e3-457f-a13d-f93b6999c8a8/what_is_an_engineering_notebook.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73c37dc2-5be6-4d56-bc95-eb8f2148405f/94051815606.pdfIn PDF document text
- https://4c982f7a-b72b-446d-8c7a-5e2d6818c0db.filesusr.com/ugd/519a61_7e68f41581424a60ab3f2b3818e4435f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0b31878b-d570-45d9-b6ac-7a36ba7e56bf/jorezurananotip.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd4d5410-f634-4105-850a-865771978679/galuwumosuzimuzuw.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd8bd3d2-a9f2-4f29-985d-381abdc81e29/6696745086.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f1d4a3bb-36de-4f96-9c90-5dc5bbc25ea3/microsoft_excel_online_course_groupon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c7d254f7-256c-4da5-9a26-2d4dabb5d3c6/73515161025.pdfIn PDF document text
- https://7e073981-ad1c-4081-8dc0-76946ba36063.filesusr.com/ugd/c4f63d_516defb2704c4b2c91e70c8284dca43e.pdf?index=trueIn PDF document text
- https://db532842-334f-4efb-8993-e67ec8f20ff5.filesusr.com/ugd/bc5be3_37da76d8428d442581ccb3570136ecfb.pdf?index=trueIn PDF document text
- https://04fc2a56-3ca8-4b90-bfe8-b05f9e7ed3d8.filesusr.com/ugd/51e9d0_e43bd925a2ed498cb7cf133b599cc3ec.pdf?index=trueIn PDF document text
- https://436c154b-1c2d-4c60-9768-ed3a268ef5e1.filesusr.com/ugd/e8e253_8f0aa53f39994de2bc8f9623e9ce39ec.pdf?index=trueIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000103f5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x103F5	5624 bytes
SHA-256: `456cb1e8f43f8175e67cf31f6221b556b591945cfcc6c48ffaf779ca80c57e11`
`font_01_sfnt_off000116f8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x116F8	1796 bytes
SHA-256: `dfab3945eace5ba27be1ad95d63d5142397767eab6bca27773794b33bda2302c`
`font_02_sfnt_off00011f82.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11F82	11292 bytes
SHA-256: `20a37941ab761ba7b2770a57ec8aa4facfca697b385b1c82fde57e45cfdc18c7`

Open this report in the interactive analyzer, or submit your own file for analysis.