PDF malware analysis — malicious · 55706efe34fef688

MALICIOUS

PDF

80.2 KB Created: 2021-03-12 06:52:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c02d6ace5b8d42e1ba25e94948feda6e SHA-1: 969a25756abd8f3f3014d2f272afa692ac551be1 SHA-256: 55706efe34fef688af246251402ca8e793bc972723eb6d04f5fc7f5fe7ec293a

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO manipulation tactic. One prominent external URI points to 'https://jacksth.ru/award?keyword=niccol%25C3%25B2+ammaniti+anna+pdf+gratis', which is likely a lure for users searching for specific content. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as phishing or a trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.8998

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/award?keyword=niccol%25C3%25B2+ammaniti+anna+pdf+gratis
- https://static.s123-cdn-static.com/uploads/4471985/normal_5fc7fb95e8be1.pdf
- http://world-wild-shop.com/simple_price_list_template_freel4n1z.pdf
- https://static.s123-cdn-static.com/uploads/4378167/normal_5ff24b9116dde.pdf
- http://rastet-malysh.ru/ecological_stoichiometry_bookgoxoh.pdf
- https://cdn-cms.f-static.net/uploads/4490949/normal_6029cbc681f8c.pdf
- http://gayerkan.com/kitchenaid_artisan_stand_mixer_5_qt_whiteh6117.pdf
- http://kawlites.online/how_to_turn_water_heater_pilot_on7uiex.pdf
- https://cdn-cms.f-static.net/uploads/4448556/normal_60199512dabc1.pdf
- https://momiweporav.weebly.com/uploads/1/3/4/7/134745900/3065277.pdf
- https://cdn-cms.f-static.net/uploads/4446038/normal_600b940b86c28.pdf
- https://melesanej.weebly.com/uploads/1/3/1/1/131163783/2791038.pdf
- https://gupufema.weebly.com/uploads/1/3/4/4/134456882/jawot-zusogatifu-mifile.pdf
- http://beautysss.site/norwegian_cruise_line_december_2020garz1.pdf
- https://supavutoni.weebly.com/uploads/1/3/4/7/134713891/bazodapeli_lepifi_menewan.pdf
- http://verifiedbadges-form.com/fepipm6p6v.pdf
- https://cdn-cms.f-static.net/uploads/4497646/normal_601f027b7b77e.pdf
- http://magazok.top/56948107737ufv74.pdf
- https://cdn-cms.f-static.net/uploads/4417543/normal_601f6387540de.pdf
- https://static.s123-cdn-static.com/uploads/4420924/normal_5fc7595f5f762.pdf
- https://cdn-cms.f-static.net/uploads/4384154/normal_6018df29c44c8.pdf
- https://cdn-cms.f-static.net/uploads/4481278/normal_6021a4f6cf052.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/varoximu/lose_weight_app_apk.pdf
- https://s3.amazonaws.com/ritoma/38864928232.pdf
- https://s3.amazonaws.com/geradi/75861050288.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fbfd.bin` `719c1d56013e1245acd9b20bb8dabdc2e8baa7cfca6a99fef0bb550deab85189`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFBFD	5248 bytes
`font_01_sfnt_off00010d76.bin` `3c52812b9dc3f6dad2e6298ccea92092ee7662406cdbf33f1af392eb7f40f94e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10D76	11268 bytes
`font_02_sfnt_off0001320f.bin` `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1320F	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.