PDF malware analysis — malicious · f2af34e5c23cf43b

MALICIOUS

PDF

72.1 KB Created: 2021-03-25 01:53:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29

MD5: a3766ed3b5079dd91d6a86207c19a28f SHA-1: 01fd285138c552ff40dc730308efcff4d4768a53 SHA-256: f2af34e5c23cf43bb0252d52381f188a88fbb2b2f0425e5c4617a2cc3f181390

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing numerous external links, many pointing to disposable hosting and potentially malicious domains. Heuristics indicate a link farm designed for SEO manipulation or to serve as a distribution point for further malware. ClamAV detection and ML classification confirm its malicious nature, suggesting it's a phishing or trojan delivery mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.9613

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pelibifir.ru/award?keyword=les+antonymes+des+mots+en+francais+pdf PDF link annotation
- http://ijmalan.xyz/tuvixolelexowi80qmn.pdfIn PDF document text
- http://trendmobile.ru/fm_radio_circuit_diagram391ad.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4475738/normal_5fdde83f88e4c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4465131/normal_5fda3e4061fe7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460944/normal_6014f7dfe5447.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4456999/normal_5ff3731d94422.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495696/normal_5fd8262b7629f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://pebotavafusu.epizy.com/canon_eos_m10_specs.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bae97028-4218-440b-b404-5da846aeb2f4/dell_poweredge_2950_server_memory_upgrade.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1faa9047-604a-4c6f-8f56-b5bd0141bb9b/58329824176.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7349e443-d6ee-4ff2-935d-22b897afbdad/zolatoxumifazaxikevu.pdfIn PDF document text
- http://rawijubewivakom.rf.gd/33966523725.pdfIn PDF document text
- http://jadufabusen.epizy.com/ng_book_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/817d54ca-8ddd-4fe4-ba50-87c2232ccf5b/95818194676.pdfIn PDF document text
- https://8569cc17-8b2a-4187-ace0-95b0550b99f0.filesusr.com/ugd/d6eede_27b4ee29116a42d6aa1c643f39084a3d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1b9dd95f-1c97-4719-aef5-6494e6d4542a/lubaledufelunusuzisunoda.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d1d153b5-2f72-4df4-b698-c1ec8ff9db00/home_zone_es00730v_security_led_motion_sensor_flood_lights.pdfIn PDF document text
- https://d1ced4a1-fa29-4c66-b583-77209f32159a.filesusr.com/ugd/c88d8b_d574267008974a699f0536fb4f8c4a45.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/54fd2b11-4d7c-4af1-b27b-6bd5801982f1/when_is_e_peoples_choice_awards_2020.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f9a65414-283c-42ab-8f6d-bb0c46f12f7a/how_to_verify_bitcoin_in_cash_app.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d170.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD170	5312 bytes
SHA-256: `6d2af9f1cdddb5a06b6a22db111c8c58f4df9d31fe6637fabe72d2d4f3e640a7`
`font_01_sfnt_off0000e37a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE37A	11808 bytes
SHA-256: `608036970d81699c3d497ce05b1cd033ed08f37f519f9f3aebcb644d0dffa0e7`
`font_02_sfnt_off0001098b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1098B	16280 bytes
SHA-256: `be5c93f85830975468b6599037ccde94e754e58123c5454e71727c6c354f817a`

Open this report in the interactive analyzer, or submit your own file for analysis.