PDF malware analysis — malicious · ee398d5555056629

MALICIOUS

PDF

63.8 KB Created: 2021-04-23 04:08:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13

MD5: 9056bb1760bb904b91da60211f393b63 SHA-1: c7fc720d231d190fbff71ec20b709925c3899670 SHA-256: ee398d5555056629b23ae1531d0d6641c5ba0c35f80bc3d94fb590b60f3c46d3

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains embedded links and is classified as malicious by ML and ClamAV. The document body, though heavily obfuscated, appears to be a lure related to refrigerator repair, suggesting a phishing attempt. The presence of multiple external URIs and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicate a link farm designed to redirect users to potentially malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9111

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vectorcorp.net/sites/default/files/webform/resume/86303695333.pdf In PDF document text
- https://www.uts.cw/sites/default/files/webform/50818196885.pdfIn PDF document text
- http://www.pacificsportfraservalley.com/sites/default/files/webform/90877516301.pdfIn PDF document text
- https://www.ofalloncasting.com/sites/default/files/webform/tasuwagorefovufozibojer.pdfIn PDF document text
- https://www.mainephilanthropy.org/sites/default/files/5296457674.pdfIn PDF document text
- http://www.friendlycc.com/sites/default/files/webform/mitiporaju.pdfIn PDF document text
- http://oaklandchildcare.org/sites/default/files/webform/55178968397.pdfIn PDF document text
- https://www.mainephilanthropy.org/sites/default/files/guvobirewuge.pdfIn PDF document text
- https://vectorcorp.net/sites/default/files/webform/resume/danodajanenalidadalibebav.pdfIn PDF document text
- https://www.ofalloncasting.com/sites/default/files/webform/dapajinosez.pdfIn PDF document text
- http://pilgrimland.com/sites/default/files/webform/resume-uploads/2923424149.pdfIn PDF document text
- http://cicatsalud.com/html/sites/default/files/webform/foxegedukob.pdfIn PDF document text
- http://pilgrimland.com/sites/default/files/webform/resume-uploads/40494538869.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=how+to+replace+ice+maker+in+kenmore+elite+refrigeratorPDF link annotation
- https://www.healthdata.org/sites/default/files/resumes/sutuzosugogaw.pdfIn PDF document text
- https://ubmemeaensoprod.s3.amazonaws.com/ifsec_international/call_for_papers/2021/03/kozavexol.pdfIn PDF document text
- https://www.healthdata.org/sites/default/files/resumes/nufimogunuzin.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cfe2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCFE2	5064 bytes
SHA-256: `defb1e9e3b95829d9c9e290d151eb4f85dd403d1db63fadf632d8f0a6f2129b4`
`font_01_sfnt_off0000e114.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE114	10604 bytes
SHA-256: `7fa90b58553ad81057c6712cd793899855c30244b53603a35fc027e9edb6292d`

Open this report in the interactive analyzer, or submit your own file for analysis.