PDF malware analysis — malicious · 7a356d55e1cad201

MALICIOUS

PDF

72.1 KB Created: 2021-03-19 04:26:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10

MD5: d612a126ac1698e4e76e6b08bae80531 SHA-1: f83fc0cf26962d53b53bb6290f7aeaa64d634524 SHA-256: 7a356d55e1cad20148ace5603715788ef49964bcfe35302848ec5c198445f4fb

184 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to potentially malicious content. One prominent URL, https://mezovuduw.ru/wix?keyword=growtopia+mod+simulator+apk+download, is presented as a download for a game mod, likely a lure for phishing or malware distribution. The PDF structure and embedded links indicate a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.7238

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/wix?keyword=growtopia+mod+simulator+apk+download PDF link annotation
- https://sotoxitubomiv.weebly.com/uploads/1/3/2/6/132695919/5dc00e4.pdfIn PDF document text
- https://cdn.sqhk.co/zijigemeworu/jXjRDSz/lixorijaxajaj.pdfIn PDF document text
- http://converstarget.ru/ice_hockey_goalie_3d_modelzoqes.pdfIn PDF document text
- http://help-copyrightservice.xyz/xyz_porn_comicsowhuz.pdfIn PDF document text
- https://lafadulow.weebly.com/uploads/1/3/4/5/134591129/xawew-rozegewim.pdfIn PDF document text
- https://cdn.sqhk.co/zizenozi/ibFhjfu/pottery_wheel_for_sale.pdfIn PDF document text
- https://murarukaxew.weebly.com/uploads/1/3/4/6/134666391/tidozasimunajuj-wozoxidu-nenuli-mozalutuduze.pdfIn PDF document text
- http://garant-ritual.online/sketchup_install_plugin_manuallylbmdz.pdfIn PDF document text
- http://igclienteam.com/badger_1-83a_leaking3ovzd.pdfIn PDF document text
- http://pubguckazan.com/toefl_test_vocabulary1u9nm.pdfIn PDF document text
- https://midejewafefo.weebly.com/uploads/1/3/4/0/134000268/bc94bafee407.pdfIn PDF document text
- https://duxudalo.weebly.com/uploads/1/3/4/8/134866109/8036528.pdfIn PDF document text
- https://cdn.sqhk.co/vozevadijut/bUif1Yc/football_cards_champions_league_2020.pdfIn PDF document text
- https://cdn.sqhk.co/jesisoritet/RgeS4ib/bipufufujobu.pdfIn PDF document text
- http://getplafond.xyz/47992068790vw31v.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://6c473ef0-402e-45f0-9f95-6bc7e89a6a1a.filesusr.com/ugd/5518c3_46e83c4a63a24f58ba1bec0ca5216720.pdf?index=trueIn PDF document text
- https://8c1dc56a-a131-4b43-acff-3635b9115217.filesusr.com/ugd/90423f_389b3862f4134365b2675ad7eca75f80.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e00c03dc-840c-46b3-9a20-f34aa6c32dfd/tasefanamafoj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75552ce2-6abb-4001-ad7e-4ce5541d5b21/how_does_penelope_know_its_really_odysseus.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1796e78f-c877-479a-b44e-e47a36aeabc2/kenmore_ultra_wash_2_parts.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01b67717-5406-4579-bfcd-d42d6c8079f6/how_many_sentences_is_a_short_paragraph.pdfIn PDF document text
- https://4121a797-204a-431c-92a8-8e24072fb342.filesusr.com/ugd/b972d5_55ce55a8a73a42629a08d57d12ca661d.pdf?index=trueIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e631.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE631	5292 bytes
SHA-256: `68113631a7a20952706cedfe34c27f82f785b7ffc1d1a225bba34e9939b476c8`
`font_01_sfnt_off0000f82c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF82C	10604 bytes
SHA-256: `f8a958b6cc007a798438bdf01d5e30e6bbbe4b571b256219a2b4a5ea7b28f708`

Open this report in the interactive analyzer, or submit your own file for analysis.