PDF malware analysis — malicious · 4555f214488ca877

MALICIOUS

PDF

93.2 KB Created: 2021-03-20 18:27:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fd030f2d620489ca51883bc389db9344 SHA-1: 66ab901d1e35a9ffdb2e38a6e0760f49f516a3b1 SHA-256: 4555f214488ca877e417eefbb7e4c254426d286c18edff5dd44e40ea7a5c7a19

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO-based phishing or malware distribution. The heuristic PDF_SEO_LINK_FARM indicates a large number of these links, with one prominent example being https://zijobukevas.weebly.com/uploads/1/3/1/4/131454580/9487a38.pdf. The embedded URL https://nipisod.ru/wix?keyword=nox+security+apk+download+uptodown further suggests a lure for users searching for software, likely leading to malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9973

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/wix?keyword=nox+security+apk+download+uptodown
- https://zijobukevas.weebly.com/uploads/1/3/1/4/131454580/9487a38.pdf
- https://nipujari.weebly.com/uploads/1/3/1/3/131384055/84cf83036.pdf
- http://rineset.xyz/bambukat_hd_video_songktlz0.pdf
- http://gromstroy.com/92146128884hc4vg.pdf
- https://diwekivoveludu.weebly.com/uploads/1/3/5/3/135313391/2540175.pdf
- http://trikotoria.ru/evolution_of_earths_atmosphere_worksheet_answerssmsn3.pdf
- https://kamararexunazo.weebly.com/uploads/1/3/1/4/131453861/7518845.pdf
- http://gromstroy.com/tokizumosuwuowjmt.pdf
- https://vikerurinarifu.weebly.com/uploads/1/3/0/7/130776567/4942cd4a46a84.pdf
- http://idealicaitaly.site/5395077361738aue.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/woxorojero/how_to_rap_godzilla_eminem.pdf
- https://97783159-ced7-426e-9fbd-60d2bb3342fb.filesusr.com/ugd/00058f_05eb8eb3340a49f4ad82af6798c9cdbe.pdf?index=true
- https://c941d99d-b58b-4215-81ce-525e38db2b81.filesusr.com/ugd/2dc4cf_99697aa7fc394c22bf636d7980098011.pdf?index=true
- https://s3.amazonaws.com/jikopot/73711610305.pdf
- https://s3.amazonaws.com/vifusupegiza/moteweji.pdf
- https://s3.amazonaws.com/jasipefulaxiduj/fekoso.pdf
- https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_c059952fbb0a4bb696ae9ac0b8620020.pdf?index=true
- https://uploads.strikinglycdn.com/files/8dccd1df-c3ad-4a89-b785-341f11cb5f0c/nikivif.pdf
- https://uploads.strikinglycdn.com/files/036d49ae-2f16-4cf0-98b6-2f1eed157d3a/javunamuperojixitolasaw.pdf
- https://uploads.strikinglycdn.com/files/8a786ec8-3f84-48bb-b493-25d5d2d326b5/what_is_the_importance_of_effective_communication_in_nursing.pdf
- https://s3.amazonaws.com/betefowubevat/what_exercise_burns_the_most_calories_in_the_least_amount_of_time.pdf
- https://s3.amazonaws.com/jivala/tukowerepikugakolak.pdf
- https://s3.amazonaws.com/sukedil/android_assets_file_not_found.pdf
- https://s3.amazonaws.com/zopenave/74660194674.pdf
- https://s3.amazonaws.com/sulasatevirexo/87550022197.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e709.bin` `629123bfde0685c5f69bbdd27ec008bde0224d5c30af1dabb990f6ee33ea778e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE709	6440 bytes
`font_01_sfnt_off0000f6cc.bin` `d8b907802410e675ceca2784509e58a9dae2947c1b2ad43e3e0c02687eabed47`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF6CC	2952 bytes
`font_02_sfnt_off0001015a.bin` `7e8aaef4cbb742a784e34b0415ec91bdf66a1ad72f6fcba72ecebbb04b3e8dd3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1015A	5360 bytes
`font_03_sfnt_off000113c2.bin` `2337a5f0350ff7905632306aba2ea3eb8701a1e7cdfc105f808b1fc8a614ada6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x113C2	6444 bytes
`font_04_sfnt_off00012ade.bin` `d0a043a3091b6250d2bd87662f8f369b10935d6232bede55e200f1e1b1ef9870`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12ADE	10920 bytes
`font_05_sfnt_off0001505a.bin` `18f56b7fae04e07bc119a468ad323bdda099da77b0772854d1c47cc1f39b9f3b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1505A	16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.