PDF malware analysis — malicious · 0023000894ce5349

MALICIOUS

PDF

85.8 KB Created: 2021-04-24 17:46:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 53a002c00cf8ffbd4d21084211314e6c SHA-1: 29c1df422ef6809b7b9c1263c02f3d434081bdcb SHA-256: 0023000894ce5349e483b6a782190819281fc6a87945768cfd665e10d3f097c2

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to SEO-optimized PDF files, indicating a link farm or phishing attempt. The primary URL, https://seumenha.ru/strik?utm_term=cost+to+replace+washing+machine+door+seal, suggests a lure related to appliance repair costs, likely to trick users into visiting a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/strik?utm_term=cost+to+replace+washing+machine+door+seal
- https://gukijofajileraw.weebly.com/uploads/1/3/4/3/134392650/1295c2a7.pdf
- http://gugibugud.mygamesonline.org/bipap_a40_brochure.pdf
- http://siwupojotuj.getenjoyment.net/notarojogixepe.pdf
- https://nuvomananakoleg.weebly.com/uploads/1/3/1/4/131453817/5068590.pdf
- https://wewuketis.weebly.com/uploads/1/3/5/3/135327502/bb3b7.pdf
- https://relorurexo.weebly.com/uploads/1/3/5/3/135391300/fb50ca0d40.pdf
- https://suxokigivulumu.weebly.com/uploads/1/3/4/4/134479742/wobodanitazivix.pdf
- http://lelekelosutov.getenjoyment.net/60841833063.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/netinuwa/37938711021.pdf
- https://s3.amazonaws.com/zufaxepixiguxax/strong_bases_are_weak_electrolytes.pdf
- http://mobukug.myartsonline.com/65099790137.pdf
- http://sawesupunozigiv.atwebpages.com/xixomovoruwajupuwekuv.pdf
- https://s3.amazonaws.com/gofiguj/biduji.pdf
- https://s3.amazonaws.com/tikofaketonub/pomuweselemuroran.pdf
- https://c9977776-9e37-4432-9eae-e541147807da.filesusr.com/ugd/bb6cc6_7da5b2a6fbca47718d8c84941bb4aecc.pdf?index=true
- https://s3.amazonaws.com/dejazuvorira/251898598.pdf
- https://s3.amazonaws.com/bulikowexunepov/46655000548.pdf
- https://s3.amazonaws.com/feliso/environmental_studies_mcq_with_answer_key.pdf
- https://91953a53-6f32-4f2a-9b2e-0f954541ff31.filesusr.com/ugd/dad90e_94a648b2026948fb8dbc5f0dd87a4deb.pdf?index=true
- https://s3.amazonaws.com/zodererezuzuxi/pokemon_fire_red_wrath_of_dark_mewtwo_download.pdf
- https://s3.amazonaws.com/xamibebulosaxug/55219753444.pdf
- http://telusomabufa.onlinewebshop.net/79626275530.pdf
- https://fa53e508-d88d-41cb-897c-7a5b6f1bfcc3.filesusr.com/ugd/361045_6f198483d03b47caa1234f1c8ab9499c.pdf?index=true
- https://8b5ac0f3-2bc4-49a6-9a99-2541af31b215.filesusr.com/ugd/f2ef67_06c0f7078e174532803835afdaa84274.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010458.bin` `4161ea52b73a37fcc6c52d9eeea9c14273c1eb91557bb8ddd1f01d48b5d48707`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10458	5388 bytes
`font_01_sfnt_off0001168a.bin` `de270ff194f92d369f52011910445be60763d2b31d71249c732215295a70f117`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1168A	10656 bytes
`font_02_sfnt_off00013b00.bin` `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13B00	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.