PDF malware analysis — malicious · dd8c596af190b10d

MALICIOUS

PDF

61.0 KB Created: 2021-04-03 14:04:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6fd0fa11169f072ac651f8eace5989cf SHA-1: a1c6e8c29aff104e59a6846d11b4a54f11ee3b9c SHA-256: dd8c596af190b10d5360070a16900d963a722f3c465ebd8a23e33f2a08f4c99a

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many pointing to disposable hosting services, suggesting an attempt to redirect users to malicious content or phishing pages. The document body, though heavily obfuscated, contains text related to charging a power bank, likely a lure to disguise the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9545

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://leonvi.ru/strik?utm_term=how+long+does+it+take+to+charge+a+duracell+power+bank
- http://gobizuzajov.22web.org/acgih_handbook.pdf
- https://kuzogirig.weebly.com/uploads/1/3/4/7/134748708/jalapabifa-sanedizov-bixamisiz.pdf
- https://nobarikanu.weebly.com/uploads/1/3/1/4/131483152/nomuluvaluw_womurajitigube_jeviwawo.pdf
- https://gabexilo.weebly.com/uploads/1/3/4/1/134109250/881199.pdf
- http://vezizulavojunif.22web.org/68878148998.pdf
- https://pasezoxe.weebly.com/uploads/1/3/5/3/135347718/lotalixabowoti.pdf
- http://vurenosul.22web.org/ar-15_magazine_holder_for_belt.pdf
- https://julamukipupa.weebly.com/uploads/1/3/0/7/130739907/memuwopababol-wositonofijunow.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://nugafafekovad.epizy.com/beden_dili_kitab.pdf
- https://uploads.strikinglycdn.com/files/96a17357-69cd-44f6-9ff7-c7832e8b3921/manonivujepakivedisut.pdf
- https://uploads.strikinglycdn.com/files/52f736aa-65a1-4ba6-ac6c-fe1ae16c71ab/genim.pdf
- http://dolawiwabipaz.epizy.com/zivuvivojejupusudatosix.pdf
- http://dumixagaw.rf.gd/felozewazuneka.pdf
- http://pelatid.epizy.com/sexape.pdf
- https://uploads.strikinglycdn.com/files/64074c9e-e9f4-4786-be6a-fb8a03f9824f/the_purple_book_occupational_therapy.pdf
- http://segoxegigo.epizy.com/h_t_n_full_form.pdf
- https://uploads.strikinglycdn.com/files/fcaff529-06b3-4535-a594-6d1f9426600c/what_size_furnace_do_i_need_for_a_double_wide_mobile_home.pdf
- http://dapolejalufimi.rf.gd/87182142975.pdf
- http://bezofiwod.rf.gd/worage.pdf
- http://liwubujuwu.epizy.com/kitituxe.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ce64.bin` `55e8628e7e9f440acb2ae621ceac2abe823c3fd153fe988b84025466e3c93529`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCE64	5592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.