PDF malware analysis — malicious · 956718153f7572b0

MALICIOUS

PDF

63.2 KB Created: 2021-04-23 02:42:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25

MD5: fb56cca2e925643119463f65b22df123 SHA-1: 380cafb51f6b8a3637dec98ddcab5a177b3799ba SHA-256: 956718153f7572b0f0b1c95d2bb2999df1af4361af64ecfdea85ae08f019713b

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'PDF link farm'. The primary malicious URL, 'https://xezojetit.ru/strik', suggests a phishing or malware distribution attempt. ClamAV detection and ML classification further support its malicious nature, indicating it's likely a phishing or trojan delivery mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.9136

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xezojetit.ru/strik?utm_term=free+printable+guided+imagery+scripts PDF link annotation
- http://fullhp.info/38320891365td7ae.pdfIn PDF document text
- http://smirnoff-optic.com/62589391703rlzwp.pdfIn PDF document text
- https://cdn.sqhk.co/womafafowix/IggRhhu/xigusafewebazarimitewi.pdfIn PDF document text
- https://cdn.sqhk.co/tefulobesa/hhIje8x/filowinizofija.pdfIn PDF document text
- https://cdn.sqhk.co/vuvupewog/k0ztHig/vegas_national_park_road_trip.pdfIn PDF document text
- https://cdn.sqhk.co/rufebumu/0Wy0jbk/12269538136.pdfIn PDF document text
- http://ogranicbio.space/fufazoraxedenujam7mmem.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/rozebofukixus/email_extractor_pro.pdfIn PDF document text
- https://s3.amazonaws.com/tikoweravisixu/gunol.pdfIn PDF document text
- https://s3.amazonaws.com/minaxigevani/74076699545.pdfIn PDF document text
- https://s3.amazonaws.com/lixisariwulo/linigurisusubogosij.pdfIn PDF document text
- http://zejowupifodoj.rf.gd/chacha_chaudhary_sabu.pdfIn PDF document text
- https://s3.amazonaws.com/legenapi/algebra_2_regents_review.pdfIn PDF document text
- https://s3.amazonaws.com/fadobirak/how_to_install_minn_kota_trolling_motor.pdfIn PDF document text
- https://a29d81ee-e589-4368-99bd-4e0be04eb4c0.filesusr.com/ugd/a89e6e_825facde6b2643dd9a4d4404b17c9ab3.pdf?index=trueIn PDF document text
- http://bededojobafepeb.rf.gd/how_to_log_into_my_cloud_dashboard.pdfIn PDF document text
- https://33edd578-4186-4695-89f3-f56a5a23fc53.filesusr.com/ugd/f17c08_25d162bcfb104a6c8527f3d02af041ae.pdf?index=trueIn PDF document text
- http://delanuzapuz.rf.gd/pazovojogam.pdfIn PDF document text
- https://39c1d623-eccb-4af0-a86a-15328a2d61f9.filesusr.com/ugd/3cb6cb_b4e2a2fb56a8481ea2c2b652476d6f18.pdf?index=trueIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e9e2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE9E2	5588 bytes
SHA-256: `c6c6b4ed00d10696cd48e38bdd559ecf211643f0870cbb88bbaad57882ea95d6`

Open this report in the interactive analyzer, or submit your own file for analysis.