PDF malware analysis — malicious · 743983494151ded3

MALICIOUS

PDF

102.2 KB Created: 2021-05-22 13:40:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25

MD5: 3b1d9ec75e5d400e91b6b37872577a55 SHA-1: 015745154b600ba52bd97a9173682e5794293f64 SHA-256: 743983494151ded34005866b1c1ac8f62e767487c2e16cf26ab26ff303df8c33

184 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file functions as a link farm, presenting a deceptive lure related to a free download to encourage users to click external links. The primary link, 'https://golowaki.ru/strik?utm_term=seerat+un+nabi+shibli+nomani+pdf+free+download', redirects to a collection of other PDF files hosted on various domains, indicating a phishing or SEO manipulation tactic. The presence of multiple external links and the ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggest malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.6852

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://golowaki.ru/strik?utm_term=seerat+un+nabi+shibli+nomani+pdf+free+download PDF link annotation
- https://nibolujadi.weebly.com/uploads/1/3/1/3/131381302/08d532.pdfIn PDF document text
- https://zanonolupurezo.weebly.com/uploads/1/3/3/9/133997165/db26433d242.pdfIn PDF document text
- https://fugokepak.weebly.com/uploads/1/3/4/8/134856046/2779032.pdfIn PDF document text
- https://samabuwe.weebly.com/uploads/1/3/0/7/130739499/7001010.pdfIn PDF document text
- https://palekamenagogu.weebly.com/uploads/1/3/2/6/132682235/bimudodu-mudedisepekumi.pdfIn PDF document text
- https://goxapumub.weebly.com/uploads/1/3/4/8/134884232/8767753.pdfIn PDF document text
- https://gojamomer.weebly.com/uploads/1/3/2/8/132815882/fobimebez.pdfIn PDF document text
- https://danifiwap.weebly.com/uploads/1/3/4/5/134585556/9647d96d9c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a64360e5-b5c3-4d09-94c6-61b17ba63372/14534723003.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3311885c-171c-4194-a7c7-ff9d4b6cd18b/nipelonifevasole.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0ce70a47-c14a-4ad4-a351-e9fc37aafc27/mitsubishi_mr_slim_not_responding_to_remote.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/96597702-79b6-4233-aa41-82346d98aee9/plantronics_voyager_5200_bluetooth_headset_charge_case.pdfIn PDF document text
- https://s3.amazonaws.com/zodererezuzuxi/11191083419.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ac8a1ffe-553a-427f-beb2-335c6b8eda66/grohe_faucet_parts_near_me.pdfIn PDF document text
- https://s3.amazonaws.com/vonutavekip/83831148181.pdfIn PDF document text
- https://s3.amazonaws.com/biwubeleba/cabal_ph_patch.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7ba16ba6-2168-4cc0-85b7-7dcb49491e4a/91430032961.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9a00605d-eb96-4b54-b8ac-713a9e0d5a24/baby_girl_names_2021_australia.pdfIn PDF document text
- https://s3.amazonaws.com/jinabom/vubapudidufunuvebum.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/91025103-d0b7-4b4a-9f63-887731c99901/75877772562.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c09568d8-a372-4c37-a05b-b4f1665190d1/56786252788.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4d5933ae-5225-413b-bd6b-08e3e34ac75f/how_often_to_change_power_steering_fluid_honda_pilot.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
- http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_006_off00017b61.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x17B61	20789 bytes
SHA-256: `3577c0587b1e324d916b41734dab5864803e4ab843df19b6aba1b40b234e8239`
`font_00_sfnt_off00012ac3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12AC3	5616 bytes
SHA-256: `e6431952229a350c9b7c01588118d397a658a7c747b33ae6f094a17817ca8406`
`font_01_sfnt_off00013db6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13DB6	7028 bytes
SHA-256: `aee93ac872cc2156b57f4633d044101d7a8b905d5a21e15e73596e9095391782`
`font_02_sfnt_off00015420.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15420	11460 bytes
SHA-256: `228136a9706f2bf2dfb041a90fe58e248fcc0786be2b83751425c05a19318b63`

Open this report in the interactive analyzer, or submit your own file for analysis.