PDF malware analysis — malicious · f3622c843f36bc16

MALICIOUS

PDF

76.3 KB Created: 2021-03-23 12:37:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8437e76287ec087f82af957df11b8d98 SHA-1: 6644b1ac9e96e05567e6824d9b540d6b0ab97a7c SHA-256: f3622c843f36bc163417b599de9127456267896575ed4421bda28aa917c3210d

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying a link farm designed for SEO purposes. One of the primary external URIs points to 'nipisod.ru', suggesting a potential phishing or malware distribution lure. The ClamAV detection and ML classifier further indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.7578

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/award?keyword=diagnostico+de+cirrosis+hepatica+alcoholica+pdf
- http://jsexj.fun/94971069390me8op.pdf
- http://cosmosqrab.online/brave_frontier_mod_apk_terbarua9bfn.pdf
- http://ogranicbio.space/coleman_presidential_3_furnace_filtern54n9.pdf
- http://samewejasaka.iblogger.org/79995550138.pdf
- http://begokawepene.22web.org/familial_cerebral_cavernous_malformation_ghr.pdf
- http://kinoxca.xyz/narojusasuwnbcb.pdf
- http://gratoraama.space/kepoviserereh1v9q.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/takateg/wubanirabizaz.pdf
- https://171e2b11-24ea-4535-acac-f971ec821c4b.filesusr.com/ugd/a07927_af818ad858dc4fcca4701060142fdf26.pdf?index=true
- https://s3.amazonaws.com/pozokimepe/social_media_strategic_plan_template.pdf
- https://s3.amazonaws.com/pusixa/fitted_bed_sheets_egyptian_cotton.pdf
- https://aefbb2f1-1cfc-4a48-aab2-d72547d84173.filesusr.com/ugd/2f3ac6_74f8a0f4c24242a8a70ed105016bec24.pdf?index=true
- https://uploads.strikinglycdn.com/files/20855616-f3cf-4436-a46a-a5f959cd673e/abnormal_psychology_in_a_changing_world_9th_edition.pdf
- https://uploads.strikinglycdn.com/files/e448f95b-f1f1-4bdc-b95b-f4934dcc70f0/16712261947.pdf
- https://s3.amazonaws.com/nakuzafol/is_the_stock_market_open_new_years_eve_day.pdf
- https://uploads.strikinglycdn.com/files/2399cb49-c00d-477d-88b6-1a74cd7e841a/ejemplo_de_manual_de_procedimientos_de_una_empresa_de_servicios.pdf
- https://uploads.strikinglycdn.com/files/612a9eda-759d-42e7-8300-dc97723f13ba/how_to_make_a_circle_diagram.pdf
- https://s3.amazonaws.com/pozokimepe/kapajoko.pdf
- http://vibibidazez.epizy.com/zurutakoralog.pdf
- https://s3.amazonaws.com/wefemabeni/nupesubukawa.pdf
- https://s3.amazonaws.com/dotivaf/zelienople_police_reports.pdf
- https://s3.amazonaws.com/vukusa/call_recorder_app_for_android_9.pdf
- https://uploads.strikinglycdn.com/files/ca682507-97e7-47ba-aad6-17a22b5ac3ad/apollo_twin_quad_mkii.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000121c0.bin` `84f541575a8b03976fbc09eaa710c245ecb8391ec1495b10fcc3b3c35d7a0c3c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x121C0	5416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.