PDF malware analysis — malicious · 4a07cb87fb5f0ac0

MALICIOUS

PDF

78.5 KB Created: 2021-04-05 16:22:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13

MD5: 79f9d5ca3d000f78d323958cfc6d45d0 SHA-1: 30116059dda6d3b1c91c9e9ee8cc0c882d804a9d SHA-256: 4a07cb87fb5f0ac01040471da7a8c1bb88d0a6d537432449b9d39c372fedaf03

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, with one pointing to a suspicious URL, suggesting it's part of a link farm or phishing campaign. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document may be designed to trick users into downloading and decrypting a password-protected archive, which often contains malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9993

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pelibifir.ru/strik?utm_term=my+favorite+things+john+coltrane+full+album PDF link annotation
- https://cdn.sqhk.co/towevefizub/hxjc3ji/word_connect_2020_word_puzzle_games_mod_apk.pdfIn PDF document text
- https://cdn.sqhk.co/gobopovupav/jvjcVgc/tiktok_real_followers_app_download.pdfIn PDF document text
- https://novufetus.weebly.com/uploads/1/3/4/1/134131343/501973.pdfIn PDF document text
- https://cdn.sqhk.co/xedasuzefer/jhic0if/street_fighter_iv_champion_edition_offline.pdfIn PDF document text
- https://cdn.sqhk.co/noneniwetav/hbcCid4/9910430822.pdfIn PDF document text
- https://datotumegodipe.weebly.com/uploads/1/3/2/7/132740351/5ee3434e9a85.pdfIn PDF document text
- https://kofovozeregom.weebly.com/uploads/1/3/4/3/134313602/pivabogumis.pdfIn PDF document text
- https://cdn.sqhk.co/zubavagi/gdYShjZ/dimecuba_travel_hialeah_florida.pdfIn PDF document text
- https://galatowev.weebly.com/uploads/1/3/4/3/134325578/kiburilo.pdfIn PDF document text
- https://cdn.sqhk.co/savunowudob/jdjf70M/30131883849.pdfIn PDF document text
- https://cdn.sqhk.co/voguzasijur/jnjdJJ4/alto_s_odyssey_free_ios.pdfIn PDF document text
- https://feruzizujuvete.weebly.com/uploads/1/3/0/7/130775768/givosowunopije.pdfIn PDF document text
- https://cdn.sqhk.co/berirenike/gLTVWTJ/55965016051.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/8bf84236-b887-4731-9246-51fc98855bef/76011441696.pdfIn PDF document text
- https://s3.amazonaws.com/fewunadupop/dixuzofokevebilomonebezu.pdfIn PDF document text
- https://s3.amazonaws.com/nodetuxapabara/fixaxazakexotasosur.pdfIn PDF document text
- https://s3.amazonaws.com/verirejon/why_is_my_panasonic_phone_not_working.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b9baa0c5-c583-4d1c-9852-b77b5cb90d42/what_stores_sell_oreck_vacuum_bags.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9a16a91-0af3-4e62-a956-28acf511bed9/20127979805.pdfIn PDF document text
- https://s3.amazonaws.com/moduluzuxikari/navixarujalobidado.pdfIn PDF document text
- https://s3.amazonaws.com/mubemutolewe/natubunufexobuxab.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c8f44c22-3ef9-4e26-9b46-6fc5bd7d95ba/18842851728.pdfIn PDF document text
- https://s3.amazonaws.com/lomogas/android_bitmap_to_byte_array_no_compression.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9e5b804d-b4f0-40d2-a061-daa4dcbdcca1/zmodo_app_not_working.pdfIn PDF document text
- https://s3.amazonaws.com/risalenefazozo/36187863482.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f19d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF19D	5676 bytes
SHA-256: `9d894d0cd06181f4c4b67c79db285f27aee4f24a318a8526d5d6aa5e37b82e96`
`font_01_sfnt_off000104f7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x104F7	12088 bytes
SHA-256: `a2ecbbcbb75543b29bdd63a53c87011c331d21481e31867d3c693a9a0d9be743`

Open this report in the interactive analyzer, or submit your own file for analysis.