PDF malware analysis — malicious · c81cec9a2a3c641b

MALICIOUS

PDF

63.8 KB Created: 2021-06-01 02:33:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 81093dc94fee31b56998b91e529ef6ff SHA-1: dd158f893f1cdd38a3e25873b19f9bb8c90f98ad SHA-256: c81cec9a2a3c641b8a86fa74eb73892ba8842cd536754ada941c5e9809cae92f

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file exhibits characteristics of a phishing lure, presenting itself as a movie streaming page to entice users to click on embedded links. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, suggesting a link farm or redirection scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9753

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://synerhu.ru/pbw?utm_term=istanbul+tatili+filmi+full+izle
- https://ferosikapomizud.weebly.com/uploads/1/3/4/5/134526037/betataxajegiko.pdf
- https://gonoloxezejuje.weebly.com/uploads/1/3/1/4/131410007/bepunaberi.pdf
- https://cdn-cms.f-static.net/uploads/4403808/normal_6058ba8a1c1a6.pdf
- https://cdn-cms.f-static.net/uploads/4379220/normal_605865f9ca676.pdf
- https://cdn-cms.f-static.net/uploads/4367640/normal_6026ecd58206d.pdf
- https://cdn-cms.f-static.net/uploads/4485436/normal_60496cbb9e9ee.pdf
- https://cdn-cms.f-static.net/uploads/4426088/normal_606e87d8e51c0.pdf
- https://static.s123-cdn-static.com/uploads/4379485/normal_5ff20236c80e6.pdf
- https://dujedagopodiku.weebly.com/uploads/1/3/4/5/134580966/6e95fafb29e4.pdf
- https://static.s123-cdn-static.com/uploads/4385028/normal_5ffa31b7556ff.pdf
- https://bipalokepug.weebly.com/uploads/1/3/4/4/134492575/vevufofakamag-wabulokom.pdf
- https://lalupapetawosi.weebly.com/uploads/1/3/2/8/132816164/bimug.pdf
- https://pifabevab.weebly.com/uploads/1/3/4/7/134721676/fb469.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/83fb8b09-365f-49cf-98b0-67aa43e77365/witcher_3_hearts_of_stone_good_ending_guide.pdf
- http://niwomif.pbworks.com/f/89028019831.pdf
- https://uploads.strikinglycdn.com/files/230ff0c1-0c78-4b3a-93b5-a8642144f81d/76512928983.pdf
- https://uploads.strikinglycdn.com/files/593f7dbc-fbd1-4a33-9878-37f5fb07c637/longman_phrasal_verbs_dictionary_free_download.pdf
- https://uploads.strikinglycdn.com/files/400e47fc-b905-4453-846b-0b8ccf704a36/vadejebu.pdf
- http://visetululiv.pbworks.com/w/file/fetch/144422967/the_conjuring_2_full_movie_in_tamil_download_isaimini.pdf
- https://uploads.strikinglycdn.com/files/37a83e3f-470c-4151-8198-3d25da97e800/denufobebubag.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e199.bin` `5fe8cda0593681d212e020491cab2f3d1871ebd1f7071ea4f5043f19b34aabc9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE199	4944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.