PDF malware analysis — malicious · ab1f09acf6b41ae0

MALICIOUS

PDF

67.6 KB Created: 2021-03-07 08:20:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25

MD5: bc6fc865acd72e0c0ce344e483578a6f SHA-1: cd327a4c29b8a2faa9dc420fc54813f48f1fcdc7 SHA-256: ab1f09acf6b41ae033990b0bbad15b3c12a20f7b05dc8d2c23c49c11b27d0c90

184 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many hosted on disposable domains, indicative of a link farm or SEO manipulation tactic. ClamAV detected this file as a phishing trojan, and ML classifiers also flagged it as malicious. The primary malicious activity appears to be directing users to external content via a link farm.

Machine Learning

Nyx PDF Classifier malicious score 0.8692

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://baarspo.ru/aws?utm_term=effective+c%252B%252B+%25E4%25B8%25AD%25E6%2596%2587+%25E7%2589%2588+pdf+github PDF link annotation
- https://cdn-cms.f-static.net/uploads/4416139/normal_5fdaaad659ecc.pdfIn PDF document text
- https://noxerurivago.weebly.com/uploads/1/3/4/7/134767941/2501344.pdfIn PDF document text
- https://solatozelejas.weebly.com/uploads/1/3/4/7/134714892/3521890.pdfIn PDF document text
- https://pazonijozofax.weebly.com/uploads/1/3/1/6/131606668/6686948.pdfIn PDF document text
- https://delidanazej.weebly.com/uploads/1/3/2/6/132681463/tezije.pdfIn PDF document text
- https://podogavefa.weebly.com/uploads/1/3/1/4/131438056/5938260.pdfIn PDF document text
- https://vadalafazewa.weebly.com/uploads/1/3/4/8/134897988/xukazozesadexaxibabi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412582/normal_602c1f92a3d0d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481397/normal_601b8d10c724b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://b7f5b04e-b247-49a4-9dc0-39f0c843ec09.filesusr.com/ugd/b56f86_ef4f5aa587af4be2a4cd4bb490f86831.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/loranoduzuja/luxury_travel_guide_vietnam.pdfIn PDF document text
- https://51da6a7d-ee05-4a49-87ee-1b74af3aeb07.filesusr.com/ugd/b80405_f240beec655143c282c45ac279972154.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/legapatatezisa/tofidokadedejomubo.pdfIn PDF document text
- https://s3.amazonaws.com/dikomavomem/vejetuzexivigajemirixiz.pdfIn PDF document text
- https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_23ebd4329ee947aeb2660aecf20ca19b.pdf?index=trueIn PDF document text
- https://4abf464d-34d5-4c80-8de5-e64f30e04530.filesusr.com/ugd/8b3eb5_de4a1bdd38d547519e73da961289596d.pdf?index=trueIn PDF document text
- https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_d055ca7baeaa4a9f800c6c5c676ee515.pdf?index=trueIn PDF document text
- https://469ee322-798e-4c1d-9571-af6764901f97.filesusr.com/ugd/57169b_810daa48e4a04d44b791795368e6e40e.pdf?index=trueIn PDF document text
- https://ed59cdd8-0d75-4634-8bb2-7afdb9da103e.filesusr.com/ugd/9cb112_044ea5227c3b4a8880fea51771260841.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zodawanuror/leatherworking_skill_guide_vanilla.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e6ed.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE6ED	3180 bytes
SHA-256: `8eda308321c54d7bc41b2da2a02a2a5ca68447d596116e8c637d37b3d0112828`
`font_01_sfnt_off0000f201.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF201	3392 bytes
SHA-256: `e5af583c8c822d2560b75e60defc5cfb9f05bc82d6427609a3f8c693f0d02377`
`font_02_sfnt_off0000fe06.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFE06	4724 bytes
SHA-256: `10525ef266a23f088ad9472326d0bac72eca03640183195dd314b113e24d7603`

Open this report in the interactive analyzer, or submit your own file for analysis.