PDF malware analysis — malicious · df708d17390ba67c

MALICIOUS

PDF

79.2 KB Created: 2021-05-21 00:55:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: b0fd359a3d70ed2f039061892f3b361a SHA-1: c4fb8e8afcd3290c3434f2a602f5b4a961700534 SHA-256: df708d17390ba67cc697e46ee0135e6173375e5b7ef81c628c140ee10b0288f7

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing lure, specifically using an image to redirect users to a malicious URL. The embedded URL, https://leonvi.ru/strik?utm_term=what+is+the+difference+between+a+running+record+and+miscue+analysis, is identified as a redirector for phishing. ClamAV also detected this file as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.7502

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://leonvi.ru/strik?utm_term=what+is+the+difference+between+a+running+record+and+miscue+analysis PDF link annotation
- https://static.s123-cdn-static.com/uploads/4391335/normal_5fed750e3b49e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369190/normal_606ea096bd3bb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425209/normal_605de1818caf5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484997/normal_603e6d666dbd7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4408879/normal_5ff01ad469134.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4465003/normal_5ff586a8dc935.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4388274/normal_5fefdbf15fd21.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4500877/normal_5fc8f16f72345.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6b1f6b00-577c-428c-a056-e9a034b0f132/what_the_coldest_it_gets_in_ocala_florida.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8567e763-e5dd-4a7b-9ea7-f4553d6a1f2a/libro_significado_de_los_sueos.pdfIn PDF document text
- https://s3.amazonaws.com/jazuravazaguz/fijoxepetupibigeneton.pdfIn PDF document text
- https://s3.amazonaws.com/lowebemuwojiso/curso_de_ingles_online_gratuito_senai.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4d83c1a3-c786-4f0b-ab03-f815c24cb753/attack_on_titan_movie_part_1_live_action_english_dubbed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7ad882fe-4157-4554-b0da-d27d58fd9053/hp_elitebook_6930p_laptop_wont_turn_on.pdfIn PDF document text
- https://s3.amazonaws.com/pisedij/81023994782.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f5395d84-5b26-498c-8303-4d5e98720fd3/hisense_dehumidifier_70_pint_with_pump_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9ad57cb1-a0ba-4742-aa5b-8440a9a1b5b2/carson_dellosa_answer_key_6th_grade.pdfIn PDF document text
- https://s3.amazonaws.com/zevutebulaworel/convert_to_word_arabic_ocr.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a021b5e0-2cb0-41b4-a7bd-1b3a9314ced0/zorukufomikamu.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eeb8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEEB8	5780 bytes
SHA-256: `7e20d87842f66627122af8a135dffbaabc60fc9932d9e4c3f4f1ee2eede3c14d`
`font_01_sfnt_off0001025c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1025C	11272 bytes
SHA-256: `231d8f503b19893ea64d54f2051a0f72a97f2299cd0aeab87641010ad3672443`
`font_02_sfnt_off0001289a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1289A	16204 bytes
SHA-256: `a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd`

Open this report in the interactive analyzer, or submit your own file for analysis.