PDF malware analysis — malicious · df61e8bec3123c8e

MALICIOUS

PDF

73.6 KB Created: 2021-03-19 08:33:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 323bb7f5fb81b22eb11a02e5a650d010 SHA-1: 85d9fa796905faa9b60c9680a7ea54a8fb2f794b SHA-256: df61e8bec3123c8ea371dc89ffa8abe6bf17da8fcaa44aec524cc669e113866c

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, and contains numerous embedded URLs. One URL, 'https://soxebez.ru/award?keyword=sap+abap+certification+dumps+pdf', is presented in the document body, suggesting a lure to trick users into clicking it. The PDF structure and embedded links indicate a phishing or malware distribution attempt, likely using a spearphishing attachment vector.

Machine Learning

Nyx PDF Classifier malicious score 0.8985

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://soxebez.ru/award?keyword=sap+abap+certification+dumps+pdf
- https://ribigitapupag.weebly.com/uploads/1/3/4/8/134887221/tabud_vagojazaveg.pdf
- http://tunabamilusi.mypressonline.com/budaya_jawa_barat.pdf
- http://mobufuwiwid.medianewsonline.com/48159091961.pdf
- https://lupemofuxuxutuj.weebly.com/uploads/1/3/1/3/131383332/3425011.pdf
- https://fotofewoxa.weebly.com/uploads/1/3/4/8/134849098/9a02827a7.pdf
- http://samelike.site/forgot_google_password_on_android_phone9h3ht.pdf
- https://cdn.sqhk.co/zeliravepuj/jjljgO3/nijavowina.pdf
- http://xxlmature.site/plug_dj_bot_commands90gyt.pdf
- http://guxetiz.22web.org/behringer_bcf2000_daw_controller.pdf
- http://helpverifybadges.com/34169344846lbmix.pdf
- https://cdn.sqhk.co/nafolekuge/qhigjqe/mid_course_test_form_g_answers_geometry.pdf
- http://retys.fun/tom_sawyer_rush_videojl710.pdf
- https://cdn.sqhk.co/jopogoxom/jidG0id/81404783422.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://vivazuriperulus.epizy.com/how_to_use_your_gift_of_discernment.pdf
- https://s3.amazonaws.com/kakekojezutok/how_to_use_canon_ij_scan_utility_mac.pdf
- https://s3.amazonaws.com/tokudapele/english_adventure_movies_hd.pdf
- https://s3.amazonaws.com/sezebepit/47072423699.pdf
- http://tuwofexuguxu.epizy.com/blossom_hill_soft_and_fruity_nutritional_information.pdf
- http://lazuletezofik.onlinewebshop.net/zolizeb.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f24b.bin` `6ac3612040c32cbc936870d4a4bc8b817b3107bbc1531b6a5c1a356d9122450f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF24B	5512 bytes
`font_01_sfnt_off000104eb.bin` `8e49ff198f9923a462df2a7fe90e2cd1fb9ac19db4b3c9f342e4cb015bef8317`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x104EB	11216 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.