PDF malware analysis — malicious · 2dede5a0aaea98a5

MALICIOUS

PDF

90.7 KB Created: 2021-03-23 16:49:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0d93296b4ffdf8ebfe687b04e2401d03 SHA-1: 2eb17b0099103256c843ced57d9ecb9f960fbd31 SHA-256: 2dede5a0aaea98a51563a60743009a10550485148e2e32f71e0d4bfe7062a202

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, suggesting a link farm or phishing attempt. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic indicate an attempt to direct users to potentially harmful external sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9925

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://druttle.ru/wix?keyword=2000+camaro+ls1+manual+transmission
- https://static.s123-cdn-static.com/uploads/4481055/normal_6008411fd98c9.pdf
- https://cdn.sqhk.co/kinemefuwa/hghaeix/origami_heart_box_instructions.pdf
- https://paxolobiwoke.weebly.com/uploads/1/3/1/1/131163878/7d075bcfe2.pdf
- https://static.s123-cdn-static.com/uploads/4413111/normal_5ffb28c88f1b2.pdf
- https://jevokave.weebly.com/uploads/1/3/4/2/134266272/6735085.pdf
- https://cdn.sqhk.co/jifedibodo/n8Egfic/gazugutaregetuxutipipopup.pdf
- https://karoxenerom.weebly.com/uploads/1/3/0/7/130739074/zugivedek-jabalatum-funipotoro-zuvobetej.pdf
- https://wilulesutazi.weebly.com/uploads/1/3/3/9/133997377/4ae9d1b5f.pdf
- https://cdn.sqhk.co/rubupidorinu/dBIhjij/used_furniture_huber_heights_ohio.pdf
- https://cdn.sqhk.co/kevapaboxer/hxvu6D8/glitch_intro_maker_free_no_watermark.pdf
- https://cdn-cms.f-static.net/uploads/4485173/normal_6057e4424687c.pdf
- https://static.s123-cdn-static.com/uploads/4413850/normal_5fdd221439ff4.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://7e62deb9-9b1a-4e2d-8b60-9a8f762ee201.filesusr.com/ugd/1f553f_ea027eab5bb6408ba551393fbc6838af.pdf?index=true
- https://uploads.strikinglycdn.com/files/1c89de58-1878-490b-9521-1fca828b8d1a/principles_of_mathematical_analysis_ebook.pdf
- https://uploads.strikinglycdn.com/files/584c74e0-64be-4d74-88c8-342b723d633d/75347533690.pdf
- https://uploads.strikinglycdn.com/files/aab2c7bd-314b-4330-8dc0-bb698a32fdd1/28772054837.pdf
- https://uploads.strikinglycdn.com/files/7222d14b-d3fa-4817-b437-b8908340559f/47637050754.pdf
- https://d99d9bf7-a5e0-49f2-90ac-0d1bc881463d.filesusr.com/ugd/0182ef_62fe1bacf2f4496ab6141debe385b6b6.pdf?index=true
- https://4db61c00-1078-4917-8a1c-a2c1480eb6e0.filesusr.com/ugd/c94206_fb3099c22a674ae2ac975c7c9f602ed3.pdf?index=true
- https://d5cf7a15-73c9-49c9-ad57-d4f0303abb0c.filesusr.com/ugd/0d002d_8af6cd28cd044c7f974e155841ea9072.pdf?index=true
- https://b84c3727-5d5a-4c5d-9d5d-21cac87b3a69.filesusr.com/ugd/fdd6c2_a2bae830adb44df5a15800156f23413f.pdf?index=true
- https://uploads.strikinglycdn.com/files/bec24e3e-28b2-4935-8dda-b44b1cea9b06/is_there_a_camera_on_kindle_fire.pdf
- https://6bc553e5-d0de-4278-827a-c77c8eb32fbd.filesusr.com/ugd/4a6c57_3b91946f0cad43298ba3955ba6dcfea9.pdf?index=true
- https://932aa67c-856a-4fda-9fc8-fe3f50d4acc2.filesusr.com/ugd/a25eee_32790897e8c34bf78bfa453a17e094ec.pdf?index=true
- https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_8c256ac982cc439e94718e02cc3bcfdc.pdf?index=true
- https://891dfe3a-8969-4df2-b253-5ccc4ebbb7a0.filesusr.com/ugd/e66789_d411c669929d40d5a52687d2c3854c86.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001033b.bin` `a1669b68d825bd59c16d8d8db02fe4b088eee7cbbc1882d6ff4abaf13524ddf8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1033B	4940 bytes
`font_01_sfnt_off000113d3.bin` `62f8178c2fa53ab137fb5425dbb83947c8caedebdd5b498158e899cc48afaacf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x113D3	11232 bytes
`font_02_sfnt_off000139eb.bin` `713933360072c9d59346590fad668f98c3603c6d2b72ed941ce85481f6af0b74`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x139EB	16060 bytes
`font_03_sfnt_off00014e7d.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14E7D	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.