PDF malware analysis — malicious · 5f558da50d98923d

MALICIOUS

PDF

77.7 KB Created: 2021-04-09 08:16:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 2fadd3bf6d4b95ae6d23a17f071a4f38 SHA-1: ffb0e34861a4397331108e7b9b20feabe5786142 SHA-256: 5f558da50d98923d962a0dbab25fa3264501a8735619710106297e33e2d0ebaf

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-themed and point to other PDF documents, indicating a link farm or SEO poisoning attempt. The ClamAV detection and ML classifier also flag this PDF as malicious, specifically as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and embedded links suggest it's designed to redirect users to potentially malicious sites, likely as part of a phishing or malware distribution scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.9761

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/strik?utm_term=economics+for+dummies+3rd+edition PDF link annotation
- http://gawudubigojan.getenjoyment.net/krishna_auction_theory_second_edition.pdfIn PDF document text
- http://get3creditscores.info/413432056579lkah.pdfIn PDF document text
- https://polabobaxadujo.weebly.com/uploads/1/3/4/7/134775235/zodobi_jegone_foxot.pdfIn PDF document text
- http://mutujejeturuduf.medianewsonline.com/45457735426.pdfIn PDF document text
- http://invitesistem.ru/besazizitipileucy6r.pdfIn PDF document text
- http://raisinslabs.club/arborists_certification_study_guide4ui49.pdfIn PDF document text
- https://wifusudufasebo.weebly.com/uploads/1/3/5/9/135992472/gebunokigurerikef.pdfIn PDF document text
- http://dabukim.mygamesonline.org/propeller_shaft_manufacturing_process.pdfIn PDF document text
- http://sedisifoxe.22web.org/judepoza.pdfIn PDF document text
- http://babitilakibo.mywebcommunity.org/larson_algebra_2_textbook.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fujalur.epizy.com/basketball_passing_drills_for_high_school.pdfIn PDF document text
- https://s3.amazonaws.com/tiniruru/81578792923.pdfIn PDF document text
- https://s3.amazonaws.com/vovuzize/gosunugixodej.pdfIn PDF document text
- http://dusameferadulo.onlinewebshop.net/53733581437.pdfIn PDF document text
- https://s3.amazonaws.com/putelekireza/london_has_fallen_parents_guide.pdfIn PDF document text
- https://s3.amazonaws.com/dafumuxitupav/domulina.pdfIn PDF document text
- https://s3.amazonaws.com/fejififimaketo/savuselijobetori.pdfIn PDF document text
- https://s3.amazonaws.com/midaguvimabof/sex_and_the_city_cast_1.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010977.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10977	5044 bytes
SHA-256: `43c91626206336efc52d0cb2cab1fbad50c78ea29edc748f1d8df2312c73a713`

Open this report in the interactive analyzer, or submit your own file for analysis.