PDF malware analysis — malicious · 7c1049e44fa20c33

MALICIOUS

PDF

116.0 KB Created: 2021-04-06 00:34:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3d80dc9c1a8cd13fdaac4ea1b4b22eb8 SHA-1: f6b6f11202a657d79fd101efd90b66aa7c5e9ee5 SHA-256: 7c1049e44fa20c33ff1b12612aea9857c89edab4df9fe44acbaca1cb6fcdca22

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with one prominent URL pointing to a domain that appears to be part of a link farm designed to redirect users. The document body, though heavily obfuscated, suggests a lure related to research papers, aligning with phishing tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.9777

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://druttle.ru/award?keyword=importance+of+validity+and+reliability+in+research+pdf
- https://static.s123-cdn-static.com/uploads/4480899/normal_60059e275ccaf.pdf
- https://cdn-cms.f-static.net/uploads/4461516/normal_6054675428a59.pdf
- https://cdn.sqhk.co/lamidipeke/hfjdsia/basketball_battle_play_for_free.pdf
- https://cdn.sqhk.co/desixurate/idm5KNh/the_wolfpack_brothers_2020.pdf
- http://tiledevaw.22web.org/catcher_in_the_rye_chapter_1_shmoop.pdf
- http://gemofesane.medianewsonline.com/bpsc_question_bank_book_download.pdf
- https://cdn.sqhk.co/xuzalolotagi/jggiPXZ/ludo_game_project_report.pdf
- https://cdn.sqhk.co/savageven/cgjjjlU/toca_hair_salon_4_download.pdf
- https://cdn-cms.f-static.net/uploads/4493610/normal_6028e345ac537.pdf
- http://bufibinokurun.scienceontheweb.net/50795367262.pdf
- http://leludezoz.scienceontheweb.net/relux.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://puwepubofixa.epizy.com/sekezos.pdf
- http://xikusaduxofi.atwebpages.com/percy_jackson_and_the_lightning_thief_free_download.pdf
- https://44f39d5c-a655-4437-91b6-62b11e148e71.filesusr.com/ugd/eb4c03_3df66467b1714245b963a723f34ede3a.pdf?index=true
- https://435a888a-8f80-410d-aa77-77edd6e4491d.filesusr.com/ugd/51fec0_a3cc528e9ce246159eefd9683df9f160.pdf?index=true
- https://d21da297-2d1c-4020-882f-059d99c29dc9.filesusr.com/ugd/3724a2_e2a37b4213b649ed9f888daaf6fc7fbb.pdf?index=true
- https://700ceb37-22d2-47c5-9888-d858af679aee.filesusr.com/ugd/c345b0_479b819d94c842978eab79ff346b9cd8.pdf?index=true
- http://moxosisir.epizy.com/wegeromuzimene.pdf
- http://kewivawegimomu.epizy.com/74912253092.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001ae13.bin` `445b17b385a0af24c99e033ce05ce415daaa1bb63e28ca61cb09d61da8e17ad8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1AE13	5632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.