PDF malware analysis — malicious · 22c0c6b1e5d0e55b

MALICIOUS

PDF

72.1 KB Created: 2021-04-02 00:18:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25

MD5: 293c67d0180e120ceb4be49f80bb91a2 SHA-1: ddd204781e0e82b3bdf9b0c87153e96e18ea9d25 SHA-256: 22c0c6b1e5d0e55b0e7cd7d03db119833a91e887f23dec09c70a4a5a90f18275

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or SEO spam operation. The primary URL, https://nipisod.ru/wix?keyword=elements+of+drama+worksheet+5th+grade, is likely part of this scheme. While no scripts were explicitly extracted, the PDF structure and numerous external links are indicative of a phishing or malicious redirection attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9991

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/wix?keyword=elements+of+drama+worksheet+5th+grade PDF link annotation
- https://zomipawir.weebly.com/uploads/1/3/4/8/134899005/9321289.pdfIn PDF document text
- https://muvekova.weebly.com/uploads/1/3/5/3/135394778/zazesu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481275/normal_604fc69421703.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372384/normal_604fc26da41c7.pdfIn PDF document text
- https://pitinolulisam.weebly.com/uploads/1/3/1/3/131381612/2418669.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4372740/normal_60084caf3be37.pdfIn PDF document text
- https://lomabeguj.weebly.com/uploads/1/3/2/6/132695586/kokis_saxidapiw_xizobeji.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/ba8401d2-7d3a-4c8a-a45f-58c97a9e6ae9/lonabinazirupajelivobo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a4229e8-2781-4324-b2b1-5b69b2d0db44/lajemiwelaxebox.pdfIn PDF document text
- https://s3.amazonaws.com/wizedumi/modernization_examples_yahoo_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5c098db5-8cea-4bec-82f8-5b50d35725c6/what_is_the_theme_of_the_play_metamorphosis.pdfIn PDF document text
- https://s3.amazonaws.com/suxugipipolazog/gajeramekikajusesefipif.pdfIn PDF document text
- https://s3.amazonaws.com/divelikubapiwaj/61596112582.pdfIn PDF document text
- https://2e243477-d0d7-4d97-acdd-9ec3899f5e1e.filesusr.com/ugd/5ecadc_37fb649e517e41589ebb05a2ca73a0c7.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/857aaa6d-cece-442a-b845-ce1d457f6a6c/31283487017.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3aebab07-34a3-4d21-bd02-1f58bf673a5c/bajeragirubevuwew.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3f6b8db1-7a13-4d5f-a5cc-4c840fde02bd/jogatudoribuwi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45d355b9-bc1b-4ba4-9789-6e9b02c55516/how_to_sync_summer_baby_monitor_sure_sight_2.0.pdfIn PDF document text
- https://s3.amazonaws.com/vatosolikijike/18329667186.pdfIn PDF document text
- https://a3f0f489-8083-4a9a-8fa3-2e40fe1a5f8e.filesusr.com/ugd/39a0fd_4939f29764174b77b964b27d6135773c.pdf?index=trueIn PDF document text
- https://36fc1fe3-b646-4cc1-b6e9-de51469aea27.filesusr.com/ugd/3eb4bd_28b349602a47436ca0eb582ff5176b47.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/rizijubovapuk/3425439084.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c7b6caa8-82ea-441e-ae51-8f2b61e6b5ba/83520911992.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cef0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCEF0	5296 bytes
SHA-256: `1ceacaef0068674f195bb138dbcabea4caa47972ddc74f7f5a030fef5cfb2135`
`font_01_sfnt_off0000e0e6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE0E6	10508 bytes
SHA-256: `dcb0d0015eade141032a0ce62ac046e9cfcfb6f5b44e5184edb1df4771c11beb`
`font_02_sfnt_off000104d7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x104D7	4324 bytes
SHA-256: `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`

Open this report in the interactive analyzer, or submit your own file for analysis.