PDF malware analysis — malicious · 01d1bc719694b3f9

MALICIOUS

PDF

72.2 KB Created: 2021-03-10 13:15:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02

MD5: 49ec6dedf585af175c380e27449a05ba SHA-1: 6282706350b04bbc66c11880f6b79c99f7233c90 SHA-256: 01d1bc719694b3f941fa265e716da33e878c7ca83d2886aa07bf7fafaef5d4c2

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing operation. The document body, though heavily obfuscated, contains references to 'undertale fight simulator', likely a lure to direct users to malicious URLs.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/wix?keyword=undertale+fight+simulator PDF link annotation
- https://bamigifumu.weebly.com/uploads/1/3/4/4/134443618/8167739.pdfIn PDF document text
- http://sujabupinoda.scienceontheweb.net/film_review_essay_sample.pdfIn PDF document text
- http://namafafiteg.mypressonline.com/xuramipovegovo.pdfIn PDF document text
- https://jemiliwolozeli.weebly.com/uploads/1/3/4/8/134870182/rodulix.pdfIn PDF document text
- http://mobufuwiwid.medianewsonline.com/waravusuvobuboxezoxeta.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://kesupipipiret.onlinewebshop.net/zimukalodexinulul.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/393fc8a7-bcdb-4a6b-8927-e52a8d8a04c2/how_to_know_if_binomial_or_poisson.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c1f4d02d-5da6-4fe7-9696-833f17cda46f/ralopolupenekenubiwomumiw.pdfIn PDF document text
- http://reladefuxuna.onlinewebshop.net/capitalismo_consciente_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/94303723-4676-43d0-9726-6cb0406a19c6/duzoge.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/27566c5b-dc9a-4677-a559-12e3228e56af/11601162221.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3cbef111-3e00-4a24-9ae7-c914f62f1615/87658620220.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ba839210-f177-481f-ba18-48a1fb799de4/24954762908.pdfIn PDF document text
- http://mawidinivetobi.myartsonline.com/kapulaxekubajuze.pdfIn PDF document text
- http://gonegexunu.myartsonline.com/careers_in_food_science.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f26c8188-7819-4692-8a7e-c16f546c618c/67152336460.pdfIn PDF document text
- http://xijewixevav.onlinewebshop.net/does_thyroid_medication_affect_mood.pdfIn PDF document text
- http://kepawomokatuke.myartsonline.com/precalculus_with_limits_a_graphing_approach_7e.pdfIn PDF document text
- http://madepadejatutof.onlinewebshop.net/is_aggression_a_bad_thing.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b278f2c-0b2b-4c55-9d12-5c4467b3ac92/repudaxowanuwudajefu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cb57.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCB57	5196 bytes
SHA-256: `fb035e631866aa7489fa7b28c20111d7a70f29be610a758243367031ea92cabd`
`font_01_sfnt_off0000dcd1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDCD1	14848 bytes
SHA-256: `5dc6aba18bb7a3ca8c5dd89fbfd4b97270fc4385d098119e2fa98d5d821fd8a7`
`font_02_sfnt_off00010583.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10583	4324 bytes
SHA-256: `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`

Open this report in the interactive analyzer, or submit your own file for analysis.