PDF malware analysis — malicious · 590c7ddd2aff9698

MALICIOUS

PDF

64.0 KB Created: 2021-03-29 08:41:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e845cb2baf38107392199ab364930340 SHA-1: cd582697e803788ca5e74e814dff1091fc72264c SHA-256: 590c7ddd2aff9698cfa86c230c360a13445ce0cfc40521e4f5add923c918c00c

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, and exhibits characteristics of a PDF link farm. It contains numerous external URLs, with the primary ones being http://efarbok.xyz/video_er_apk_vidmatep39jf.pdf and https://crophysi.ru/strik?utm_term=la+crosse+technology+model+308-146. These URLs likely lead to phishing content or further malware downloads.

Machine Learning

Nyx PDF Classifier malicious score 0.9263

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crophysi.ru/strik?utm_term=la+crosse+technology+model+308-146
- http://efarbok.xyz/video_er_apk_vidmatep39jf.pdf
- http://fitness1.space/959956370655h5c0.pdf
- https://vasigigu.weebly.com/uploads/1/3/4/6/134607878/momefitakujabirapet.pdf
- http://thepropheticapp.com/sugokoskb0w.pdf
- https://cdn-cms.f-static.net/uploads/4455881/normal_6013723b4113a.pdf
- https://static.s123-cdn-static.com/uploads/4500453/normal_5fc68ac913276.pdf
- https://cdn-cms.f-static.net/uploads/4390642/normal_60127933b1fd3.pdf
- https://cdn-cms.f-static.net/uploads/4448323/normal_604ce67f66d07.pdf
- https://noruwapawufibem.weebly.com/uploads/1/3/0/9/130969999/vazemijilisik.pdf
- http://talakam.space/8273037601hn3yf.pdf
- https://cdn-cms.f-static.net/uploads/4454990/normal_5fd9595c5b849.pdf
- http://fakaripeti.xyz/stock_market_live_ticker_todayhtce8.pdf
- http://raisinshq.pro/38796916826h5xrg.pdf
- https://cdn-cms.f-static.net/uploads/4473622/normal_600c47079b527.pdf
- https://static.s123-cdn-static.com/uploads/4372983/normal_60089b2c2fc39.pdf
- https://cdn-cms.f-static.net/uploads/4374522/normal_605dcd4c44c57.pdf
- https://cdn-cms.f-static.net/uploads/4367912/normal_60532969ef2e9.pdf
- https://cdn-cms.f-static.net/uploads/4417997/normal_605aa2a77342f.pdf
- http://esclub.pro/desarrollo_del_derecho_penal_en_puerto_ricoq56o8.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://e108c0fa-8e70-4110-aab7-e0d30777705f.filesusr.com/ugd/d9966b_80691a27b0224b738183abf4e87b4466.pdf?index=true
- https://5e0c4d4d-41f9-428c-9564-b93e7cff6769.filesusr.com/ugd/510691_dc564eabee5f4d7c808951274e4809a5.pdf?index=true
- https://a7563df4-ba19-4d82-a8a0-b2470d957038.filesusr.com/ugd/61f964_e2194e7f46f34a8dadc33642e47f5e97.pdf?index=true
- https://4ec63ec4-77bf-4499-900e-7c522af20654.filesusr.com/ugd/35bdb9_71d7c353e9ce4ab69f747024af896e47.pdf?index=true
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e09d.bin` `a5aeecb87a2a4659e19562e5050a3948b671bce1bd9f192fd229817631796261`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE09D	6220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.