PDF malware analysis — malicious · b4457418a7ab2a79

MALICIOUS

PDF

63.9 KB Created: 2021-06-14 13:11:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3913848347b35de634a50f453dc4a914 SHA-1: 4dd7e234a6940efdb9221346a198c2e5e1c43a4f SHA-256: b4457418a7ab2a7942c1773fb7c1702e0b4c57bde3132f998cfe6c5c1ca01f35

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to potentially malicious or SEO-abused domains. The heuristic PDF_SEO_LINK_FARM indicates a mass of external links, and the ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the presence of embedded URLs and the overall structure point towards a phishing or malicious redirection scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.8196

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSEOF. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://wastran.ru/pbw?utm_term=xref+autocad+not+showing
- https://cdn-cms.f-static.net/uploads/4388174/normal_5fdb5463a41e9.pdf
- https://xugimitedekilim.weebly.com/uploads/1/3/1/4/131482884/11230695.pdf
- https://cdn-cms.f-static.net/uploads/4446790/normal_6050ad7d8341a.pdf
- https://static.s123-cdn-static.com/uploads/4402519/normal_6005437b8e655.pdf
- https://cdn-cms.f-static.net/uploads/4486374/normal_60433f2a84049.pdf
- https://static.s123-cdn-static-d.com/uploads/4402289/normal_60b6838f8765b.pdf
- https://cdn-cms.f-static.net/uploads/4419205/normal_60b9792ba45b0.pdf
- https://miregunuvarur.weebly.com/uploads/1/3/3/9/133997549/mukoraxetelon.pdf
- https://juwarojolajekol.weebly.com/uploads/1/3/4/1/134108785/9518558.pdf
- https://rakoroga.weebly.com/uploads/1/3/4/8/134887340/defoxulidenum_fusulel.pdf
- https://cdn-cms.f-static.net/uploads/4459058/normal_5fe975cd9e933.pdf
- https://cdn-cms.f-static.net/uploads/4411686/normal_5fd821e415065.pdf
- https://cdn-cms.f-static.net/uploads/4458837/normal_5fd12f682c05a.pdf
- https://zowinalonewexaf.weebly.com/uploads/1/3/4/6/134680062/vexidusosizi-fanidosid-jupotoroju.pdf
- https://cdn-cms.f-static.net/uploads/4448536/normal_60b9a1cbad5e9.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/0263b993-3f61-4627-863e-a893aaf6a23b/revosawanekidejal.pdf
- https://uploads.strikinglycdn.com/files/fdb4a08f-2904-474d-b203-27b0c31f9c20/resumen_del_libro_el_seor_de_las_moscas_capitulo_1.pdf
- http://lodenapokot.pbworks.com/w/file/fetch/144782427/how_to_check_someones_history_on_instagram.pdf
- http://vikiruji.pbworks.com/f/56217506128.pdf
- http://tisowowuduwe.pbworks.com/f/nomilomolorimosotedig.pdf
- http://dujimowiwup.pbworks.com/f/lidebizigat.pdf
- https://uploads.strikinglycdn.com/files/ef0bef81-cb79-45aa-a17d-351fed341619/niv_bible_offline.pdf
- http://mepijewaj.pbworks.com/w/file/fetch/144426291/49611279687.pdf
- http://zulusaw.pbworks.com/f/koroxafojexeri.pdf
- https://uploads.strikinglycdn.com/files/fe4433f0-6ba2-471b-93b1-77060be5e17b/risinefunigaledizixobo.pdf
- http://kibarilotog.pbworks.com/w/file/fetch/144819066/ncert_exemplar_solutions_class_10_maths_free_download.pdf
- http://refarumiba.pbworks.com/f/urdu_biographies_download.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ee27.bin` `458e2793dfd3707fbd712dfb94d71d56928584242c0fdf89cea45755b2d0272f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEE27	5320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.