PDF malware analysis — malicious · 84ec40e3cce38a32

MALICIOUS

PDF

69.2 KB Created: 2021-06-02 02:42:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 20899d64a29f88e4850b3c53f6f8e1a0 SHA-1: a894cb817821b3cb306678adb64e3bb410030742 SHA-256: 84ec40e3cce38a323049274345cfe9d7b97941f1ce25ed43333273b421584bd2

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, with one prominent URL suggesting a lure for licensed software credentials. The PDF structure and embedded links point towards a phishing or malware distribution campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.8212

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://queure.ru/pbw?utm_term=licensed+email+and+registration+code+for+4ukey+for+android
- https://weposatozexutav.weebly.com/uploads/1/3/4/3/134314203/f4cc6c07.pdf
- https://piguvedulo.weebly.com/uploads/1/3/4/7/134724556/ruzajiwigeto.pdf
- https://zisamezasebav.weebly.com/uploads/1/3/3/9/133997726/zetog.pdf
- https://nasuvanebi.weebly.com/uploads/1/3/5/3/135393195/b46c4.pdf
- https://kisobodowawon.weebly.com/uploads/1/3/1/3/131384145/45ccb99691.pdf
- https://fanamixaxa.weebly.com/uploads/1/3/4/0/134017579/zufedemeparap.pdf
- https://zopatiselinijil.weebly.com/uploads/1/3/4/7/134758238/2dc60c05115.pdf
- https://jedunifoxawixe.weebly.com/uploads/1/3/4/4/134458330/siwarirenuketek.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/2773427a-6066-44f3-ad33-07a210c690c5/74259703556.pdf
- http://pimepovume.pbworks.com/f/hazard_identification_and_risk_assessment_template_for_hospitals.pdf
- http://zajozote.pbworks.com/f/dictado_acentuacion_sexto_primaria.pdf
- http://gipomebepate.pbworks.com/f/35100869222.pdf
- http://jetipufagi.pbworks.com/w/file/fetch/144454206/canon_lbp6000b_driver_for_windows_7_64_bit_free_download.pdf
- https://uploads.strikinglycdn.com/files/d11bc5eb-c25b-49b9-b752-c9301cf95d65/22751591601.pdf
- https://uploads.strikinglycdn.com/files/ba468fde-b771-4c94-a9e2-3d191746be5e/71425771716.pdf
- https://uploads.strikinglycdn.com/files/85980001-0b13-4adb-b2ed-2c0a1fe58b13/86830734087.pdf
- http://sozakuvepar.pbworks.com/w/file/fetch/144483297/fejane.pdf
- http://zizovitunex.pbworks.com/w/file/fetch/144483444/how_to_kinesio_tape_for_pregnancy.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eee8.bin` `2020f0bc8c5932390cbe18f5f74263225621ff0946d2af32a59b6a97fb7893a7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEEE8	5536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.