PDF malware analysis — malicious · 665c80f80490565c

MALICIOUS

PDF

73.5 KB Created: 2021-06-01 13:14:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 66685a2f5bb03d34c962ee07572dc81d SHA-1: 8ff294f0232400c8e5972876436b2667b16e1e7a SHA-256: 665c80f80490565c022aea286ba8b39d4f77779d0b5d7400d58dfeb5c5fdab68

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a PDF link farm. One of the primary URLs, https://krisoc.ru/pbw, appears to be a malicious domain. ClamAV also detected the file as Pdf.Phishing.Trojan, further supporting its malicious nature. The document body, though heavily corrupted, contains text related to calculating corrugated sheet weight, suggesting a potential lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9074

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://krisoc.ru/pbw?utm_term=how+do+you+calculate+the+weight+of+corrugated+sheets
- https://dunifavopugi.weebly.com/uploads/1/3/5/3/135312205/1453230.pdf
- https://nevajuto.weebly.com/uploads/1/3/2/6/132695651/luzumoso-nabuvadulutovu-juruzupar-zorejom.pdf
- https://vavetupabon.weebly.com/uploads/1/3/3/9/133999816/vojodisezobidid-tepusejifawed.pdf
- https://rigokapine.weebly.com/uploads/1/3/4/5/134593974/garobewaxidexol-vodasa-mepawubakawimu.pdf
- https://jakuxibakamu.weebly.com/uploads/1/3/1/4/131407414/989d08195.pdf
- https://xekixaxaleza.weebly.com/uploads/1/3/2/6/132695200/5146589.pdf
- https://gogafijunovox.weebly.com/uploads/1/3/4/3/134322332/6f60eaf21c37a.pdf
- https://wotixefutakit.weebly.com/uploads/1/3/2/8/132815753/vidaxusil.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- http://kufujibumufa.pbworks.com/f/jandy_pool_heater_owners_manual.pdf
- https://uploads.strikinglycdn.com/files/1fa5a8da-f1d7-469f-96ab-3579bf892895/modo_de_produccin_capitalismo_caractersticas.pdf
- https://uploads.strikinglycdn.com/files/0ce06188-977b-4440-b8b5-f754b8beee54/1864473043.pdf
- https://uploads.strikinglycdn.com/files/8f259a3c-d463-4354-83c9-8bd7fd4ba6b3/dirt_devil_vacuum_reviews.pdf
- https://uploads.strikinglycdn.com/files/c9227b85-610b-48c4-967f-40536ae25e3d/mufibesomarunikag.pdf
- https://uploads.strikinglycdn.com/files/85505f57-d5e0-4ab5-ba96-cbbd7f8b92b5/what_does_the_number_332_mean.pdf
- http://nagomax.pbworks.com/w/file/fetch/144425670/bollywood_hd_mkv_avi_movie_download.pdf
- https://uploads.strikinglycdn.com/files/edeedc52-8889-4ff2-926b-b0a274dcbf85/hp_1320_driver_win_10.pdf
- https://uploads.strikinglycdn.com/files/5cb7e21f-4239-4140-94c0-e0cec7ed0dfe/luwikapuzege.pdf
- http://mefijunov.pbworks.com/f/butevugose.pdf
- https://uploads.strikinglycdn.com/files/59abea01-0a8c-46ff-8e30-35ee31ac7e4c/how_to_fix_samsung_plasma_tv_vertical_lines.pdf
- https://uploads.strikinglycdn.com/files/c681caa2-453f-4253-be59-1d83da5ab5fa/pioneer_avic-z130bt_reset_button.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e3d5.bin` `432af5c397f37f6275ec915d21279f412e0c90bbab0dff2104b5ad9285b335e9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE3D5	5212 bytes
`font_01_sfnt_off0000f5bf.bin` `cc69684c02d6f1d36c1396d4eb00460bc0b0cb0233fd172d3a1754f510f98d9f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5BF	10460 bytes
`font_02_sfnt_off000119a9.bin` `ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x119A9	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.