PDF malware analysis — malicious · 41bca81837cba5f9

MALICIOUS

PDF

68.1 KB Created: 2021-04-03 06:36:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6229d8489aa3ec9fc834a538551fbab6 SHA-1: fafa7fcc9bdb14ba97122a15fc58a6a033ac64cf SHA-256: 41bca81837cba5f956f7658ffc72aa897b051d44ccfac059d5234fcdc8230bd8

212 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a PDF document flagged as malicious by ClamAV and an ML classifier. It contains a large number of embedded URLs, with at least one identified as a malicious redirector and others contributing to a link farm. The primary attack pattern appears to be directing users to potentially harmful external content through a large number of links within the document.

Machine Learning

Nyx PDF Classifier malicious score 0.8381

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/award?keyword=bac+international+maroc+pdf
- http://sadovik.me/karthik_dev_serial_telugu_lo_ingvm4u5.pdf
- https://wimukevefom.weebly.com/uploads/1/3/0/7/130739067/sekuduvi.pdf
- https://goreduve.weebly.com/uploads/1/3/2/7/132740848/1514008.pdf
- https://cdn-cms.f-static.net/uploads/4384045/normal_600f99c482056.pdf
- https://cdn-cms.f-static.net/uploads/4387571/normal_602783e8c9508.pdf
- https://melubezu.weebly.com/uploads/1/3/4/3/134311229/lafuru-bobomoko-tuverefenubosi-xobejalen.pdf
- https://bikugepoxo.weebly.com/uploads/1/3/5/3/135351236/nulikovoko.pdf
- https://cdn-cms.f-static.net/uploads/4423700/normal_601555f6dac6c.pdf
- https://waretufiwad.weebly.com/uploads/1/3/4/5/134581883/pedepasugexajubejul.pdf
- https://static.s123-cdn-static.com/uploads/4457592/normal_5fed0c0384ea1.pdf
- http://lnstagramverifiedbadgeservice.com/proceso_de_roscado_con_machuelomzwur.pdf
- https://rorenaziva.weebly.com/uploads/1/3/1/8/131871817/tizivujuli.pdf
- http://7gusevshop.space/molalopavisozuktmtzb.pdf
- https://lalazifesulalo.weebly.com/uploads/1/3/4/5/134502535/dabapemerilopa.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://pelubameta.epizy.com/narikorufaluduvigiduwigi.pdf
- http://bojobepuxotu.rf.gd/atoms_elements_and_compounds_test.pdf
- http://zakidudo.epizy.com/ap_grama_sachivalayam_merit_list_2020_download.pdf
- http://daduzafez.epizy.com/merajelagalo.pdf
- https://uploads.strikinglycdn.com/files/c97703ba-3ffa-4c76-a1a1-554927c7b1ba/feeding_hannibal_a_connoisseurs_cookbook_ita.pdf
- https://uploads.strikinglycdn.com/files/f7f36198-c776-4cac-a0a9-19163fdad8fa/hampton_bay_gazebo_ii_ceiling_fan_instructions.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e3c6.bin` `b97a0fa09bb7c9c11665ead9adb96c24007a23d26ba2ca75178a5288b2b6f352`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE3C6	5172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.