PDF malware analysis — malicious · 2b6dde872461d642

MALICIOUS

PDF

90.2 KB Created: 2021-03-18 16:48:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 32e84a1be201114d584731c154d54b71 SHA-1: 1fdb22d51dd6fdb1c329b8458041eab524eb14fe SHA-256: 2b6dde872461d642cba24a1b37149aec860ab4b1582aed2f50c9376ed09787af

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a "PDF_SEO_LINK_FARM". One prominent URL, 'https://baarspo.ru/wix?keyword=tyrone%2527s+unblocked+games+run', suggests a lure related to online games. The presence of ClamAV detection and ML classification further supports its malicious nature, likely as a phishing or redirection document.

Machine Learning

Nyx PDF Classifier malicious score 0.9955

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://baarspo.ru/wix?keyword=tyrone%2527s+unblocked+games+run PDF link annotation
- https://static.s123-cdn-static.com/uploads/4474999/normal_5fde07e5f3092.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453327/normal_603056ad4958c.pdfIn PDF document text
- http://buwovavozu.getenjoyment.net/surilowevuniz.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4475725/normal_6006e93c834a7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4452161/normal_5fce3e900bdc4.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4454561/normal_5fe20502d328f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405953/normal_604b5ae9a3d6b.pdfIn PDF document text
- http://kipegujodup.getenjoyment.net/how_to_screen_mirror_iphone_to_vizio_v_series.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4494875/normal_5fdb563535333.pdfIn PDF document text
- http://zatoxuvisovapuf.sportsontheweb.net/classifying_triangles_game.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://taberadajip.atwebpages.com/48339102807.pdfIn PDF document text
- https://s3.amazonaws.com/zufaxepixiguxax/96293118602.pdfIn PDF document text
- https://3b0fe5ff-7f86-489c-8138-fc984e51136c.filesusr.com/ugd/bfd78a_3ef8e5f6035e42a9bf3de72059d1638b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wofaxil/majomizoxur.pdfIn PDF document text
- https://3a7b682b-4b85-4b21-836a-a34929c8735b.filesusr.com/ugd/0cd3a8_17bfe225fa3848b1b1801d2abf977909.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/piwanisaj/japikijet.pdfIn PDF document text
- https://s3.amazonaws.com/jotogorurekuro/bejiveronuxen.pdfIn PDF document text
- https://s3.amazonaws.com/bevarolimesale/zofizitimaxixojimow.pdfIn PDF document text
- https://97a45c9e-1ab5-462a-bfe2-fded34b9a8b9.filesusr.com/ugd/b50c55_f35ae8f7a4c04ac9b47475f6077a9963.pdf?index=trueIn PDF document text
- https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_8bda4a5b2b2e4296942537ad14113d47.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zaxawetawupo/xurogesafafa.pdfIn PDF document text
- https://s3.amazonaws.com/bawalidamovidud/rogula.pdfIn PDF document text
- https://s3.amazonaws.com/divikufifir/wamenatinaxavenenulum.pdfIn PDF document text
- https://s3.amazonaws.com/fasomusogapovi/64357900612.pdfIn PDF document text
- https://s3.amazonaws.com/tidigudetefumof/zombie_catchers_apk_mod_unlimited_money.pdfIn PDF document text
- https://60883313-e483-4213-bdf2-3844198a3b35.filesusr.com/ugd/3ba96b_bdd1d90b9faa4cfab7a37a603351fddb.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010e90.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10E90	5548 bytes
SHA-256: `101f9e7245e40aea80e3825788f203fd3c68cf24a56938ff49c16bdd05a92f46`
`font_01_sfnt_off00012169.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12169	10536 bytes
SHA-256: `2fe2b920f063e6dbd3b7f15f16a0b61bd3292962d5a37fe2ddea3b89d21c3e45`
`font_02_sfnt_off000145da.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x145DA	16120 bytes
SHA-256: `c94926d5202b085e184a5666363eda0a421a0de498e0fbda8ae973291059b9dc`

Open this report in the interactive analyzer, or submit your own file for analysis.