PDF malware analysis — malicious · ab05e34e857e3519

MALICIOUS

PDF

68.4 KB Created: 2021-03-04 16:42:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a33051e3e8800fd62677e7fb9908b051 SHA-1: e2879abb2e030d9945800c760c4e9e3c44fc16f7 SHA-256: ab05e34e857e3519e4a2b503ad4756a9ba344857071ffc45316d9171299c9545

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a link farm pointing to external PDFs, with one primary URL identified as suspicious. ClamAV also detected it as a phishing trojan. The document body, though heavily obfuscated, contains text related to relationships, likely a lure to disguise the malicious intent of directing users to the Zajinet.ru URL.

Machine Learning

Nyx PDF Classifier malicious score 0.8464

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://zajinet.ru/strik?utm_term=how+to+say+no+to+a+man+without+hurting+him
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://7ffe38df-ef78-47a1-8632-a9c579db478a.filesusr.com/ugd/8ff694_255cda1c5dcd4efeb93ce94d1561f273.pdf?index=true
- https://s3.amazonaws.com/baxekojojexusol/free_yamli_smart_arabic_keyboard.pdf
- https://uploads.strikinglycdn.com/files/40e34088-a171-457f-abe1-a2db90f85525/80684811336.pdf
- https://edefa294-c65c-46c5-840b-8a4669b9fdfe.filesusr.com/ugd/e4a001_a4da0cdbb83842e6ad94971999d43800.pdf?index=true
- https://uploads.strikinglycdn.com/files/dfd842af-4b68-466d-8d5f-f589933b566f/what_does_an_absorption_spectrum_tell_us.pdf
- https://uploads.strikinglycdn.com/files/7de5cd7b-3aa5-4608-8796-50c3c718dc83/pijepobofadolul.pdf
- https://s3.amazonaws.com/vufuzewasi/iyengar_yoga_for_beginners_book.pdf
- https://s3.amazonaws.com/robumuduluwise/91781154369.pdf
- https://a1f0096d-76f5-425c-b826-5ccbd312c1bc.filesusr.com/ugd/8f8c07_5cb87349ad22433bb3b005680fa5c653.pdf?index=true
- https://33c7e2ec-32fc-4676-a642-9d95a4379e01.filesusr.com/ugd/622218_b9158db779a34d9a93342f61451e5a52.pdf?index=true
- https://s3.amazonaws.com/rojalexipokadaz/outlook_express_6.pdf
- https://uploads.strikinglycdn.com/files/d4a8e3be-a6e6-4388-a55c-e73499426f9d/jack_lalanne_juicers_reviews.pdf
- https://uploads.strikinglycdn.com/files/529b7d87-87a1-4eef-90d3-a84141cbfbd8/cen_tech_battery_charger_not_working.pdf
- https://s3.amazonaws.com/zesixefe/fitafapisufekor.pdf
- https://uploads.strikinglycdn.com/files/f0b13367-c01f-4229-8d58-ddf49d60937b/fisher__paykel_rs90au1_integrated_fridge_freezer.pdf
- https://uploads.strikinglycdn.com/files/0fe7777f-79dd-415e-a1fa-6f42dcc66e0b/fima_klebaner_stochastic_calculus.pdf
- https://s3.amazonaws.com/womirofop/kunatomomotejojikesowa.pdf
- https://s3.amazonaws.com/napejaxosinages/the_vampire_diaries_video_download.pdf
- https://s3.amazonaws.com/kisagoz/what_foods_contain_gluten_but_not_wheat.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f697.bin` `a0edf2b5f3334d7504403e2aee275203cdfb5ac1d32269cbc644ae7e24a6d1a1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF697	5224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.