PDF malware analysis — malicious · 8f78166f0797098f

MALICIOUS

PDF

35.4 KB Created: 2020-05-13 02:17:55 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 66f416392c8c7e5819d6b4b0f324e790 SHA-1: ba1193713c8b30b0ce677b08ca6752517d6f9843 SHA-256: 8f78166f0797098f1547cd785d2dbd2f2cf4b55f36e95a749bf7664620f6e7a0

138 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous external links, identified as a link farm, and is detected by ClamAV as Pdf.Dropper.Agent-9020639-0. The document body text, though partially corrupted, suggests a lure related to passport renewal forms, combined with visual cues like download buttons and invoice language. The primary function appears to be directing users to a network of linked websites, likely for malicious purposes such as credential harvesting or malware delivery.

Heuristics 6

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Dropper.Agent-9020639-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-9020639-0
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://revolveecowood.com/uploads/1/3/0/4/130483940/130483940.html#canadian+passport+renewal+form+for+adults+abroad
- http://higherlevellifestyles.com/uploads/1/3/0/8/130874587/kidulezuvimek.pdf
- http://aspoonfulofsugarbakeshop.com/uploads/1/3/0/8/130873949/2091434.pdf
- http://hughvaughan.com/uploads/1/3/0/6/130640190/vuwonevetixiz.pdf
- http://churchofstcolman.org/uploads/1/3/1/3/131381521/4556127.pdf
- http://mibizreview.com/uploads/1/3/0/6/130639329/rafemuwidinu_dusaxakarakad_repusuru_xaxobuwusijor.pdf
- http://boilingrivermedibles.com/uploads/1/3/1/0/131070851/fijugowusutow_zujisure_kezip.pdf
- http://cxrutgers.com/uploads/1/3/0/2/130287923/6368434.pdf
- http://photoboostlandescb.com/uploads/1/3/0/5/130590461/5470362.pdf
- http://cddtestsite.com/uploads/1/3/0/6/130639983/2f8e0d24261d8.pdf
- http://ballerevents.com/uploads/1/3/1/4/131409244/348014.pdf
- http://mightycleanoffice.com/uploads/1/3/0/6/130603931/gesazomopezuvutos.pdf
- http://photographybyherb.com/uploads/1/3/0/7/130776861/kelapokijejoti.pdf
- http://yellowmonarch314.com/uploads/1/3/1/4/131437130/3526a61c40baa.pdf
- http://sunshinecoastcounselling.com/uploads/1/3/1/0/131070688/zeminum-kelogakoxedomir-kebig-nowowagaka.pdf
- http://kimberlilewis.com/uploads/1/3/1/6/131607943/2938710.pdf
- http://yomanejoseguro.net/uploads/1/3/0/7/130739533/2187616.pdf
- http://kaostraining.com/uploads/1/3/0/7/130775045/4a4d6880a4820d.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005f48.bin` `70fc5382f80aed07e0f6033fa9e239e7304eaf60e158440af3ea404e9f7f456d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F48	10032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.