Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7544d28c78c2d57…

MALICIOUS

PDF

65.4 KB Created: 2021-02-24 19:11:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: c6d40c6f5278c2016cc4a85540b88cb9 SHA-1: d184187e322b70db376710a8534081535258345e SHA-256: b7544d28c78c2d573a1ccc76268ddf95041693c115060480a13c37c1e8e6062a
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is part of a link farm and uses an SEO redirector for "free-download phishing". The embedded URL `https://seumenha.ru/award?keyword=kenmore+progressive+upright+vacuum+owners+manual` is presented as a vacuum manual, a common lure for phishing or malware delivery. Although no scripts were directly extracted, the PDF structure and external links suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9515

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=kenmore+progressive+upright+vacuum+owners+manual PDF link annotation
    • http://899themes-demo.ru/whatsapp_free_iphone_5strqve.pdfIn PDF document text
    • https://tipowunukal.weebly.com/uploads/1/3/4/3/134355136/5921684.pdfIn PDF document text
    • https://pilonalamajavex.weebly.com/uploads/1/3/1/1/131164122/1573606.pdfIn PDF document text
    • http://gejesixave.scienceontheweb.net/30668743068.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dofufiri/araba_park_etme_oyunu_3d_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/vizegemawokaxe/incites_journal_citation_reports_register.pdfIn PDF document text
    • https://s3.amazonaws.com/kuxuxemu/wikenomarimafefewali.pdfIn PDF document text
    • https://s3.amazonaws.com/fuwenoxuzasila/information_about_lifestyle_diseases.pdfIn PDF document text
    • https://s3.amazonaws.com/vasofirida/nuzuvekebarigotita.pdfIn PDF document text
    • https://s3.amazonaws.com/loneminovu/tejakitaponadipapipolowez.pdfIn PDF document text
    • https://s3.amazonaws.com/rolefosiju/wordpress_themes_free_blog_personal.pdfIn PDF document text
    • https://s3.amazonaws.com/veraxawewib/45646996664.pdfIn PDF document text
    • https://s3.amazonaws.com/donarepemi/candy_crush_saga_hack_app_free.pdfIn PDF document text
    • https://s3.amazonaws.com/zarevizebi/transcendentalism_definition_yahoo_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/rekawexuretowo/betabuburenifutigifulon.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d39f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD39F 3144 bytes
SHA-256: f7a613fda5ba50e51826cd50f69fcbe6c52e8b39af481034a561189469b0d3cf
font_01_sfnt_off0000dedb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDEDB 5468 bytes
SHA-256: 61ab999b4ffffaa55eb13be2ccd9edcc20b8106d23eb5b15be2c825ab1ec167a

Open this report in the interactive analyzer, or submit your own file for analysis.