PDF malware analysis — malicious · 39576b4728c6b42e

MALICIOUS

PDF

114.4 KB Created: 2021-03-15 08:17:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: da38ab73337ef882bcd211c41d831a57 SHA-1: 707875df51b09118bc5c29fda9590268a5cf7c52 SHA-256: 39576b4728c6b42e94ea192f6df9bcc5109adc3b9f235d74c3ade66a37d2cce3

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are part of a link farm designed to appear as search results. The primary URL, 'https://resalured.ru/wix?keyword=locomotor+skills+meaning+in+hindi', suggests a phishing or SEO manipulation tactic. ClamAV and ML heuristics also flagged this PDF as malicious, indicating a phishing or trojan payload. No scripts were extracted, but the structure and numerous external links point towards a malicious intent to redirect users to potentially harmful content.

Machine Learning

Nyx PDF Classifier malicious score 0.9841

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/wix?keyword=locomotor+skills+meaning+in+hindi
- http://faketikus.22web.org/video_er_extension_for_uc_browser_pc.pdf
- http://nizorunux.iblogger.org/89776476144.pdf
- http://kibizife.iblogger.org/jeffrey_sachs_the_end_of_poverty.pdf
- http://pogawubujogeje.mypressonline.com/vonetugesifiz.pdf
- https://tegomufowake.weebly.com/uploads/1/3/5/9/135958876/c075d6df.pdf
- http://pidukefap.22web.org/monopano.pdf
- https://jidupedepinamup.weebly.com/uploads/1/3/2/6/132680921/3f6a786ac421.pdf
- http://vobalemujumojak.mywebcommunity.org/tudevesijevaxobibuda.pdf
- http://modozadubop.mywebcommunity.org/taotao_50cc_scooter_maintenance.pdf
- https://xixekelubijaruj.weebly.com/uploads/1/3/5/3/135329585/425928.pdf
- https://toxovapuwelubu.weebly.com/uploads/1/3/4/7/134733969/95931.pdf
- https://kuvezuwuziteb.weebly.com/uploads/1/3/4/3/134388010/c2f5d49.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://fedorahosted.org/lohit
- http://www.opentle.org
- https://s3.amazonaws.com/tapelu/life_after_mod_apk_offline.pdf
- https://s3.amazonaws.com/rekawexuretowo/bolton_analysis_orthodontics.pdf
- https://s3.amazonaws.com/jivuxo/burger_king_application.pdf
- https://s3.amazonaws.com/bezutu/plataforma_20_aula_digital.pdf
- http://porujikegen.epizy.com/49562339660.pdf
- http://jamujufumazuwir.rf.gd/fugejejeloxejomonakax.pdf
- http://zoxarulal.rf.gd/how_to_use_an_oven_for_baking_a_cake.pdf
- http://kifozelig.epizy.com/xudawijozijozubijaga.pdf
- http://megugasawixige.onlinewebshop.net/purolabuwifaloneba.pdf
- https://s3.amazonaws.com/gapivegek/what_kind_of_oil_does_a_2008_scion_xb_take.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- http://scripts.sil.org/OFL
- http://www.gnu.org/licenses/gpl.html

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_009_off000172d0.bin` `353733f804a2e2558274fa186276e52a0ba66394adb83a5c8027ac727b3d885c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x172D0	18824 bytes
`font_00_sfnt_off0000e93c.bin` `6e81f897d36290b1436dbc4eba27d2803d840529695d98761a555db702fee011`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE93C	6376 bytes
`font_01_sfnt_off0000ff39.bin` `9bcfbcc6266dceb56cf7b398914dcd3a0a140783a83ecdb2522a15f036e59184`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFF39	5360 bytes
`font_02_sfnt_off00011145.bin` `c206ac4eca120f096112d408dff6b33a2f721090936d80486df636e1cd240fde`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11145	2656 bytes
`font_03_sfnt_off00011c4b.bin` `3702365b3034b9d7945da23b991b5e2ac3f8bb06d1ba3be7e5ba1b5d8dd48c9f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C4B	2328 bytes
`font_04_sfnt_off00012702.bin` `e66bd646ff29f48b94a898642357a1d5295b77faffa0bd70eb77acb4aebc9a97`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12702	2108 bytes
`font_05_sfnt_off000130ce.bin` `eca62b72654736461a635ba366d09d794777fd95c58152d2b251becdfce657e0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x130CE	6640 bytes
`font_06_sfnt_off0001426b.bin` `17c906deb1edab8cfae297b91f44bbf159bbb1b3b99b5ecd120b80e645621827`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1426B	15800 bytes
`font_08_sfnt_off0001916e.bin` `548c613b30233b360f9b719e5a792b831a4bf61b9df2becdc9ae8b710ebbd643`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1916E	12080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.