PDF malware analysis — malicious · 1cbbe2f69c880ff9

MALICIOUS

PDF

79.8 KB Created: 2021-03-19 17:01:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20

MD5: 45316ae7b6632b68a1908404eef9e3c7 SHA-1: 6b3885cfbc5a4ab3140654997d50261286e2a850 SHA-256: 1cbbe2f69c880ff913e0dea3a60fd66defb2b170400180f343b3f080b1fa1b06

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for PDF_SEO_LINK_FARM, indicating a large number of external links. The embedded URLs and the ClamAV detection (Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) strongly suggest a phishing or malicious content distribution attempt. While no scripts were explicitly extracted, the nature of the link farm and the phishing detection point towards a malicious document, likely delivered as a spearphishing attachment.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/strik?utm_term=how+many+ways+i+love+you+poem PDF link annotation
- https://bigudiwox.weebly.com/uploads/1/3/5/3/135304820/vemulibiborosibupol.pdfIn PDF document text
- https://lemamoramu.weebly.com/uploads/1/3/5/3/135348447/goketazukego.pdfIn PDF document text
- https://fobibopokigafo.weebly.com/uploads/1/3/4/7/134702456/vanipibodat-nokos-divixuwawesavex-dosijipumewad.pdfIn PDF document text
- http://francobusiness.com/resume_templates_in_wordg02r3.pdfIn PDF document text
- https://jozisanolotodix.weebly.com/uploads/1/3/0/9/130969335/jotufugopuven-rirarikame-diwodajav.pdfIn PDF document text
- http://peuly.xyz/how_many_cubic_feet_is_a_super_capacity_plus_washershbch.pdfIn PDF document text
- http://neyroskakalka.site/winning_toefl_essays_the_right_way78o9h.pdfIn PDF document text
- http://ppl-nutrshopfit.website/43140389635w5fmb.pdfIn PDF document text
- http://garantiya62.ru/42198614064lmhop.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://bdee3e82-1fe6-4084-b289-f15f5249f83e.filesusr.com/ugd/749937_635abeef44024a8eb6126bd9e1e309e6.pdf?index=trueIn PDF document text
- https://2c91b947-1dd8-401e-ae91-d595f2f75867.filesusr.com/ugd/0af078_0f08c6f279a8457490a6f6a9c1bda870.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/suzixegazunow/koluloximiv.pdfIn PDF document text
- https://s3.amazonaws.com/potofaw/2016_ford_f_150_forscan_spreadsheet.pdfIn PDF document text
- https://dc6b22d1-fd3c-476a-b8f1-b0505981f591.filesusr.com/ugd/ab5adf_ff7d359f9def4b57ad91ba32dc8805b3.pdf?index=trueIn PDF document text
- https://5c3e38fa-bf2d-4cda-bfdc-19e9a39f2227.filesusr.com/ugd/b3ada4_f4c483a7078b4fd4a002338365e2d260.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/temujonuwu/golixebemakikenupegetimo.pdfIn PDF document text
- https://s3.amazonaws.com/didowugorokirug/40076641856.pdfIn PDF document text
- https://s3.amazonaws.com/liguwubore/one_informal_agency_of_social_control.pdfIn PDF document text
- https://s3.amazonaws.com/norozovijalu/steve_harvey_book_90_day_rule.pdfIn PDF document text
- https://s3.amazonaws.com/votawawo/instruction_manual_whirlpool_gold_series_dishwasher.pdfIn PDF document text
- https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_2865329ee0cb487694a8727c076d10cc.pdf?index=trueIn PDF document text
- https://d848e4b6-662b-4424-a759-963270729452.filesusr.com/ugd/30e015_6ec05a8114bf4ba7a2bd391586df53a2.pdf?index=trueIn PDF document text
- https://51fd5013-30c4-43d1-89ce-86564632a3b5.filesusr.com/ugd/9f06f8_ba625231399a49c4b5c340e83ba9d05c.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jedadokuti/fonilizemipodaxok.pdfIn PDF document text
- https://s3.amazonaws.com/desekusoxi/gm_diet_plan_day_1_weight_loss.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f9a9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF9A9	5084 bytes
SHA-256: `dffb2dfa4dd84919a9109373dbc877f51afb406d3bcfce88f7df907da41ea6f1`
`font_01_sfnt_off00010afc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10AFC	11172 bytes
SHA-256: `2d36b863aa6187bfd07c04aac7a2a5a98a40de8e2754247ed61fdb2d3084fe80`

Open this report in the interactive analyzer, or submit your own file for analysis.