PDF malware analysis — malicious · 0509e5373120f3ba

MALICIOUS

PDF

77.4 KB Created: 2021-03-20 06:25:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 1b18637eaaf44dc88d7c7980d6ba0c44 SHA-1: 0e4c8c3de07e5a22cacf07deace94eb4fe1093e7 SHA-256: 0509e5373120f3baaa5a8bf388e1de2ee8693a1fa1db721c01526f487e54dc2e

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or SEO manipulation tactic. The embedded content, though obfuscated, appears to be related to book quotes, likely a lure to disguise the malicious nature of the document.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/strik?utm_term=robert+greene+quotes+33+strategies+of+war PDF link annotation
- https://guzepebizosi.weebly.com/uploads/1/3/4/8/134880367/fanagoboriza_seragevitewe_wumov_tizesewe.pdfIn PDF document text
- https://porokademapu.weebly.com/uploads/1/3/4/9/134901730/kumexe-gobizukomapazib.pdfIn PDF document text
- https://xozilozevaloda.weebly.com/uploads/1/3/5/3/135391373/c16e2b41c815.pdfIn PDF document text
- http://yatvoyya.fun/181327615094ytes.pdfIn PDF document text
- https://zuzivosojix.weebly.com/uploads/1/3/0/7/130775151/sigisab-potelironadusaw-gedinigubab.pdfIn PDF document text
- https://bagukewedofitaf.weebly.com/uploads/1/3/4/5/134507185/2379914.pdfIn PDF document text
- https://japilulijerimu.weebly.com/uploads/1/3/0/7/130738614/tuxoguso.pdfIn PDF document text
- http://kpovli.ru/16631254337wgsxy.pdfIn PDF document text
- https://ledajesaler.weebly.com/uploads/1/3/4/0/134041179/1358905.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://70fbc5f3-53e4-4072-9ff7-a5862d19847b.filesusr.com/ugd/bb3bf9_bf575088934744789bfc28eb324b436b.pdf?index=trueIn PDF document text
- https://0298dc5a-7924-4276-8279-06452a5288da.filesusr.com/ugd/b30cf0_a5b7ac15bf2a46f4a0b6d20345add004.pdf?index=trueIn PDF document text
- https://86b7bb9a-6a0b-496c-a062-e8aa60c365d0.filesusr.com/ugd/dcf311_b643c533ab984c04b343ea2cd1417ca9.pdf?index=trueIn PDF document text
- https://3a00e800-a8eb-44ae-aafc-ae9aecab8e06.filesusr.com/ugd/1715bf_a13644d9dff7445e9cf17856c561a180.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wusigipufuvowix/pelobajifegomanamoketinu.pdfIn PDF document text
- https://7ed754b6-a209-4558-9281-0032c7ee8ade.filesusr.com/ugd/4329d7_f4d2ce74bf73463a803b540c9086e68b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zafijukopa/merry_christmas_songs_2018.pdfIn PDF document text
- https://fec450ea-b80f-4746-b851-35139cc02de5.filesusr.com/ugd/53a83b_681a6760076449389b587252fbc049a9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/rijaliwiguvex/wowifasan.pdfIn PDF document text
- https://0a37a3d5-a0bf-4e77-8ff5-6127fd08aefa.filesusr.com/ugd/6046c9_4d12e14e914348a5841274c55b664d1b.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f2df.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF2DF	5432 bytes
SHA-256: `36df47a6ef8fd7da1cf414ee492710b411cb67fe786e1656ff9a33c7a45abf87`
`font_01_sfnt_off00010583.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10583	10420 bytes
SHA-256: `8a328ee2bc0a1433a35184c75b2f9a95620fe72557123f610b7052047e6bd412`

Open this report in the interactive analyzer, or submit your own file for analysis.