PDF malware analysis — malicious · 867f0dae2fd3254d

MALICIOUS

PDF

71.2 KB Created: 2021-02-28 23:56:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25

MD5: b95e5258cc9bb847e9cef1c80664f67a SHA-1: 9ae80edf650bdb0d24b963078640e483f2c8a751 SHA-256: 867f0dae2fd3254d81af1986dcd0214e8e8cd442d33ec3fa632f3b450be82755

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many of which are part of a link farm hosted on disposable domains, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. The document body, though partially corrupted, suggests a lure related to a 'drug guide', further supporting a phishing or social engineering attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.7606

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/strik?utm_term=davis+drug+guide+pdf+free PDF link annotation
- http://the-english-temple.com/samipubipexinyv.pdfIn PDF document text
- http://lifeit.pro/tanimug9rcuj.pdfIn PDF document text
- http://klyshsheff.xyz/77798673702a5pv4.pdfIn PDF document text
- http://arbitestpark.xyz/bible_lesson_on_joy_for_youthsecab.pdfIn PDF document text
- https://xepozumer.weebly.com/uploads/1/3/1/3/131380160/nakagovotejefiwebir.pdfIn PDF document text
- http://sellforce.ru/bissell_spot_clean_pro_pet_ukf2myv.pdfIn PDF document text
- http://polfact.site/unbreakable_strength_hollow_knight9zydk.pdfIn PDF document text
- https://cdn.sqhk.co/jojewezalika/Hbyiajg/gagexapigojezixufo.pdfIn PDF document text
- https://kasivolonu.weebly.com/uploads/1/3/4/6/134688646/8344347.pdfIn PDF document text
- http://ritual-venki.online/game_of_thrones_season_2_english_subtitles_hboalg79.pdfIn PDF document text
- http://ru-dev.xyz/the_vampire_diaries_watch_online_frekqizp.pdfIn PDF document text
- http://coloradocustomelectric.com/can_you_take_your_motorcycle_permit_test_online_in_nykzyhs.pdfIn PDF document text
- https://cdn.sqhk.co/voxobidivel/ijhjhjm/lalosijibawefatafobiv.pdfIn PDF document text
- http://fakts.design/35396948674s0cco.pdfIn PDF document text
- http://driveformclanemilwaukee.com/is_freight_out_a_fixed_expensenm4lt.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eda2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEDA2	3212 bytes
SHA-256: `27b748ee931503da7bbd748c21e6b962001e2b36dc9ea055ea975387d771fc72`
`font_01_sfnt_off0000f921.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF921	5236 bytes
SHA-256: `fddbc6981ab178fd8d113ed29af18c0d27292a90b3c201a632a451c9f10441fc`

Open this report in the interactive analyzer, or submit your own file for analysis.