PDF malware analysis — malicious · 9143df5522fcc39a

MALICIOUS

PDF

76.2 KB Created: 2021-02-26 12:40:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21

MD5: 4d528ce694db1651be38b867dc7c3e9d SHA-1: 71437d148b0e3e7837c8eb819454609df4e60118 SHA-256: 9143df5522fcc39aaa5fe13c22cc92cc894dcd6939fbc1bef9b6f33306f954fb

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, including one that appears to be a lure related to essay writing, directing users to 'jumiwimov.ru'. Heuristics indicate a PDF link farm and ML classification strongly suggest malicious intent. While no scripts were explicitly extracted, the presence of embedded URLs and the overall structure point towards a phishing or content-luring attack, likely delivered as a spearphishing attachment.

Machine Learning

Nyx PDF Classifier malicious score 0.9761

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jumiwimov.ru/award?keyword=how+to+write+a+conclusion+for+argumentative+essay PDF link annotation
- http://tesocoin.online/91624690290cll2a.pdfIn PDF document text
- http://fishland.store/badinerie_flutegq3lh.pdfIn PDF document text
- http://tactical-jacket-sale.shop/xulemivobk161.pdfIn PDF document text
- http://labiosdewonda.com/bsc_agriculture_1st_semester_bookss6765.pdfIn PDF document text
- http://revershjtb.site/facebook_login_help_emailpdla0.pdfIn PDF document text
- https://sotipazokelaxat.weebly.com/uploads/1/3/2/7/132712266/pogabide-mokinenawodajik.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/xidazeze/43670424848.pdfIn PDF document text
- https://s3.amazonaws.com/fifuto/brushes_for_adobe_photoshop_cs3_free.pdfIn PDF document text
- https://s3.amazonaws.com/venunamazozuzo/describe_atoll_formation.pdfIn PDF document text
- https://s3.amazonaws.com/jitimesolagun/fezobixujekebam.pdfIn PDF document text
- https://s3.amazonaws.com/jebokizez/coldplay_scientist_piano_sheet_free.pdfIn PDF document text
- https://s3.amazonaws.com/wegemebufojafak/how_to_draw_cartoons_step_by_step_for_beginners_slowly.pdfIn PDF document text
- https://s3.amazonaws.com/sojuravewi/xojaduxozisenefon.pdfIn PDF document text
- https://s3.amazonaws.com/bulozor/car_test_questions_and_answers.pdfIn PDF document text
- https://s3.amazonaws.com/rovuweraja/free_editable_first_day_of_school_template.pdfIn PDF document text
- https://s3.amazonaws.com/davolazupivowi/xunegugabetobogisuxod.pdfIn PDF document text
- https://s3.amazonaws.com/susonanezaj/leveling_guide_wow_classic_alliance_rogue.pdfIn PDF document text
- https://s3.amazonaws.com/mojivikapeti/fraction_word_problems_worksheets_third_grade.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000114ce.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x114CE	5416 bytes
SHA-256: `d42e518a752139e8b35ca42c26ba03bf94cde9e818970c2d53f80b1768462f21`

Open this report in the interactive analyzer, or submit your own file for analysis.