PDF malware analysis — malicious · 3738c5653de4ffab

MALICIOUS

PDF

74.7 KB Created: 2021-04-08 18:06:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17

MD5: 7805944e440547c2aa6ab24b2de96bda SHA-1: 16ba6fd4d4e57272af5b7ab4824ad1bb03093c24 SHA-256: 3738c5653de4ffab946399e20bdc01723256879f3407da9e3e1c27e3d2eb615b

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was detected as a malicious PDF by ClamAV and an ML classifier, indicating it is likely a phishing or malware distribution document. The PDF contains numerous embedded URLs, many of which point to disposable or suspicious domains, suggesting a link farm or redirection mechanism. While no scripts were explicitly extracted, the PDF structure and heuristic firings suggest it may leverage embedded JavaScript or other exploits to deliver a payload.

Machine Learning

Nyx PDF Classifier malicious score 0.8284

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://pilgrimland.com/sites/default/files/webform/resume-uploads/64296936159.pdf In PDF document text
- https://ambrose.edu/sites/default/files/webform/82598578892.pdfIn PDF document text
- https://www.natsihwa.org.au/sites/default/files/webform/25680057182.pdfIn PDF document text
- https://www.natsihwa.org.au/sites/default/files/webform/72917344941.pdfIn PDF document text
- http://www.muttypawsacademy.com/sites/default/files/webform/vaccines/powevalixerofewum.pdfIn PDF document text
- http://www.grotekeukens.be/sites/default/files/webform/gmawards2018/48103714077.pdfIn PDF document text
- https://aboss.by/sites/default/files/webform/12404161593.pdfIn PDF document text
- http://klm3fg.grhosting.cz/sites/default/files/webform/files/kokibilelage.pdfIn PDF document text
- http://cicatsalud.com/html/sites/default/files/webform/mulakipezumaxusilexuvu.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=disorders+of+reproductive+system+pdfPDF link annotation
- https://campusrec.princeton.edu/system/files/webform/putiwokareviwe.pdfIn PDF document text
- https://lib.asu.edu/system/files/webform/simadovi.pdfIn PDF document text
- https://umatter.princeton.edu/system/files/webform/requests/tutoturabawukaxubudevodor.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f779.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF779	5220 bytes
SHA-256: `78a6098b5ba5fcb7b2181d12e870b1442f48438fe955042e8457983960dfb9a7`
`font_01_sfnt_off0001093f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1093F	10948 bytes
SHA-256: `001d184a1c40dd0180c0e356377659cebf12f93ceb4e42ec14a1a91cff29bd1d`

Open this report in the interactive analyzer, or submit your own file for analysis.