PDF malware analysis — malicious · b7a8722b200189fe

MALICIOUS

PDF

64.0 KB Created: 2021-04-04 12:44:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a1fa6420e3e41dad283fafae0e9dd07c SHA-1: 5aae819b8af32ddf23b4e7965bc5a44dbf48444c SHA-256: b7a8722b200189fe4007f74485f95e097c9aaa8ba3ea56f4dcc5d279beda8d35

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying a link farm. One prominent URL, 'https://vilenefex.ru/award?keyword=ayushman+bharat+yojana+registration+form+pdf+download', is presented in a context suggesting a lure for registration forms. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.7991

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/award?keyword=ayushman+bharat+yojana+registration+form+pdf+download
- http://xadexawufomovi.sportsontheweb.net/nibive.pdf
- https://cdn-cms.f-static.net/uploads/4380854/normal_6045d8a05477b.pdf
- https://static.s123-cdn-static.com/uploads/4460725/normal_5feb60797fe54.pdf
- http://retapadu.medianewsonline.com/autocad_lt_2019_computer_requirements.pdf
- http://zakewabo.scienceontheweb.net/alternating_current_fundamentals_8th_edition.pdf
- https://cdn-cms.f-static.net/uploads/4387031/normal_602eac87f1ef0.pdf
- https://cdn-cms.f-static.net/uploads/4410432/normal_600db9e04a6d2.pdf
- https://fegemuvu.weebly.com/uploads/1/3/2/6/132695633/2235019.pdf
- https://sopepulur.weebly.com/uploads/1/3/5/3/135311067/juwalagisanofep.pdf
- https://vojawozusuv.weebly.com/uploads/1/3/1/1/131164351/siwekufogu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/3c90454a-b70a-42fa-b6df-46df7f00fe0b/sat_prep_miami.pdf
- https://s3.amazonaws.com/gofilafixu/apache_ant_1._7._0_free.pdf
- https://uploads.strikinglycdn.com/files/4f03d8e4-5c51-4bdb-b2f2-d4ee4a32ec1a/lejevagumukifomutiju.pdf
- http://guwaxilajoxeza.onlinewebshop.net/symptom_severity_scale_carpal_tunnel_syndrome.pdf
- https://uploads.strikinglycdn.com/files/83e77f13-6a21-4ac8-9948-f295f4a0ac49/58244255335.pdf
- https://s3.amazonaws.com/loneminovu/describe_your_dream_job_interview_answer.pdf
- https://s3.amazonaws.com/gekojulog/vampire_diaries_season_8_episode_8_watch_online_123movies.pdf
- https://s3.amazonaws.com/dobikasukavu/ipcc_1._5_report_upsc.pdf
- https://s3.amazonaws.com/zaxuledo/jatadhari_bhole_bhandari_ringtone.pdf
- https://uploads.strikinglycdn.com/files/584f63c6-8432-471b-82f5-c06fa52badab/bajopidadudivuzigupodoro.pdf
- https://s3.amazonaws.com/pajeriramal/12830388093.pdf
- http://nazowovemozugiv.myartsonline.com/45637712360.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000efe9.bin` `89ca4643f5da110b90cd1a4122ec8be5ef67454698540caefe48727ad7632dc7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEFE9	5856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.