PDF malware analysis — malicious · 52af36a6dcdca535

MALICIOUS

PDF

73.6 KB Created: 2021-02-26 17:11:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17

MD5: 7aae2d9275d0c85b8e098687f0c139cf SHA-1: 9710360950beaa71e6051eecc9ab531eee245cc5 SHA-256: 52af36a6dcdca535d8e5ccce01d1c3df1dd6ad583ce5639279ea0be99b78eca7

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are hosted on suspicious domains or are part of a link farm, indicating a phishing or malware distribution attempt. The ClamAV detection and ML classifier strongly suggest malicious intent. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic further support this assessment.

Machine Learning

Nyx PDF Classifier malicious score 0.9769

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/award?keyword=first+90+days+as+a+manager+presentation PDF link annotation
- https://cdn.sqhk.co/boguzivipel/QUgdihg/wordpress_home_page_url.pdfIn PDF document text
- https://kenafidoragakox.weebly.com/uploads/1/3/1/8/131856022/bojefinusiv.pdfIn PDF document text
- https://vijujaluju.weebly.com/uploads/1/3/2/7/132741375/2670153.pdfIn PDF document text
- http://sodahub.pro/sumisedane7sk5w.pdfIn PDF document text
- https://nivunosanogerog.weebly.com/uploads/1/3/4/5/134516177/tanizetu.pdfIn PDF document text
- https://xaliwituxezaxe.weebly.com/uploads/1/3/5/3/135323019/9ab651142902e7.pdfIn PDF document text
- https://xojobade.weebly.com/uploads/1/3/4/3/134385351/2358184.pdfIn PDF document text
- http://zefanawibades.iblogger.org/free_able_templates_for_brochures_tri_fold.pdfIn PDF document text
- https://cdn.sqhk.co/lupobikud/dT9hggN/towopurot.pdfIn PDF document text
- https://cdn.sqhk.co/xuxumududu/igaghge/10467924222.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/wiwamoxamo/kujefovadegizuf.pdfIn PDF document text
- http://dupivet.epizy.com/what_is_the_point_of_the_house_on_mango_street.pdfIn PDF document text
- http://mevedokepovi.epizy.com/buyers_bootcamp_episode_guide.pdfIn PDF document text
- https://s3.amazonaws.com/jedaxopopuko/muravubanaze.pdfIn PDF document text
- https://s3.amazonaws.com/salade/new_arabic_fonts_2018_free.pdfIn PDF document text
- https://s3.amazonaws.com/joterige/cg_movie_website_list.pdfIn PDF document text
- https://s3.amazonaws.com/widuxade/gunutaweturujive.pdfIn PDF document text
- https://s3.amazonaws.com/wibedubosateg/high_thread_count_cotton_sheets.pdfIn PDF document text
- https://s3.amazonaws.com/wizidimawag/kudokageze.pdfIn PDF document text
- https://s3.amazonaws.com/legipalofi/jalegewemof.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00011350.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11350	5604 bytes
SHA-256: `d4b0131621002392c252ba2751b098df4a0b79f53b816f4e3103745c733d5bda`

Open this report in the interactive analyzer, or submit your own file for analysis.