PDF malware analysis — malicious · 6fe6d0ed1fb27925

MALICIOUS

PDF

72.2 KB Created: 2021-03-24 21:02:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e1e1af8d2e4855e5d49799a070676125 SHA-1: 23133acb4351693de9a08dc3b4caf92a12757eb5 SHA-256: 6fe6d0ed1fb2792533a90d6731191c253b99c139c6aacd157d7fd7946da51421

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, directing users to various PDF files hosted on external domains. The ML_NYX_PDF_MALICIOUS and CLAMAV_DETECTION heuristics confirm its malicious nature, with ClamAV identifying it as a phishing trojan. The embedded URLs suggest a phishing or link-farming attack pattern, likely intended to lead users to malicious content or further compromise.

Machine Learning

Nyx PDF Classifier malicious score 0.6897

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pelibifir.ru/award?keyword=easy+christmas+piano+music+pdf
- https://cdn.sqhk.co/defisepeniba/gejdu2H/98535671550.pdf
- https://xavagozewurele.weebly.com/uploads/1/3/4/5/134583143/714186.pdf
- https://cdn.sqhk.co/vopunokapire/CXehePs/business_king_game_rules.pdf
- http://bixaxivajujojar.mypressonline.com/kawededaneluxobibawuwu.pdf
- https://kowenijog.weebly.com/uploads/1/3/4/0/134096242/175967.pdf
- https://cdn.sqhk.co/pozuwifofub/Gnqgfig/rujigafakikojujaluzoju.pdf
- http://xodufaviwez.iblogger.org/aadhar_card_to_jpg.pdf
- https://tigibivimibi.weebly.com/uploads/1/3/4/3/134344299/4342999.pdf
- https://gubukaxonular.weebly.com/uploads/1/3/5/3/135349028/muriwirawetotes_korev.pdf
- https://cdn.sqhk.co/jumupebuvi/ijhfjh3/95425505908.pdf
- https://biziremidawa.weebly.com/uploads/1/3/5/3/135397591/lojajobe.pdf
- https://cdn.sqhk.co/nisugavu/1cIrhbu/zelozovinezo.pdf
- http://kifojex.22web.org/tikovijakimotuk.pdf
- http://keruluzo.medianewsonline.com/verbal_ability_for_cat_by_arun_sharma.pdf
- http://gixodugesu.medianewsonline.com/ddp_yoga_app_roku.pdf
- https://cdn.sqhk.co/besogevipadi/aZAKhcg/my_boy_gba_emulator_apkpure.pdf
- https://cdn.sqhk.co/digipexula/esnhdgc/48864632414.pdf
- https://cdn.sqhk.co/rurufimibiwe/e60dhcs/detention_center_inmate_search.pdf
- http://gejesixave.scienceontheweb.net/57032759830.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://salajire.onlinewebshop.net/62545323402.pdf
- http://zikinevubebera.epizy.com/nojomowapoxaxufowakibo.pdf
- http://kepewitibafef.myartsonline.com/all_formulas_of_calculus_class_12.pdf
- http://vebaxabono.epizy.com/agree_disagree_essay_template_pte.pdf
- http://sajatuvireguta.atwebpages.com/boerewors_recipe_book.pdf
- http://sidukumu.epizy.com/joxunusem.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f475.bin` `1445ec300a47794c504a9d6cb5cf923a6044790c12ae177a9b85f24390742e9c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF475	5424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.