PDF malware analysis — malicious · 4ce4011f6b4a2b1f

MALICIOUS

PDF

89.1 KB Created: 2021-03-19 23:24:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 10c147411d7c6f06953ed864b8425bf2 SHA-1: 9c77b988d1a3541ea8f15566d954077fb471eff6 SHA-256: 4ce4011f6b4a2b1ff62b0ef2a85251a00a3cc7dd3179c69bc2f6441d2a67bd87

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common technique for SEO spam or phishing campaigns. The heuristic PDF_SEO_LINK_FARM indicates a large number of links, and the ML classifier and ClamAV detection strongly suggest malicious intent. The embedded URL 'https://golowaki.ru/wix?keyword=pip+boy+3000+vault+111+edition' suggests a lure related to a specific product, likely to entice clicks.

Machine Learning

Nyx PDF Classifier malicious score 0.9951

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://golowaki.ru/wix?keyword=pip+boy+3000+vault+111+edition
- http://jamotovoxut.mywebcommunity.org/fewimejerafumesurijasowo.pdf
- http://netolenogafa.getenjoyment.net/74516326317.pdf
- http://winokuzovew.iblogger.org/tudorinopekapalavetezarex.pdf
- http://matemepujibad.scienceontheweb.net/alter_ego_plus_3_cahier_d_activits_corrige.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/e6c52e2e-933c-4bda-b1ae-47d1be3faabd/bexew.pdf
- https://6762652a-e869-40f3-960d-1446d4066230.filesusr.com/ugd/55e6b1_29a50afcaa014eb8ba8acd4176647361.pdf?index=true
- http://jokosen.atwebpages.com/22211763661.pdf
- https://uploads.strikinglycdn.com/files/407f4cbb-059b-4a28-8dda-2075de20c5c6/91757634653.pdf
- https://21a67f6d-2aea-439f-a910-ed4feb6be009.filesusr.com/ugd/173616_5b8aea210e854303bab1ff4872478a46.pdf?index=true
- https://14e2190e-1c7c-401b-bdd1-4e50d95f8180.filesusr.com/ugd/62a579_e8aa9c92d27d4eecb2012d4a04f65e42.pdf?index=true
- https://uploads.strikinglycdn.com/files/8a24d270-ad6e-4bd5-a318-779c21b8d120/duoandikoetxea_fourier_analysis.pdf
- http://ruvatarojamun.rf.gd/wondershare_filmora_8._3._2.pdf
- https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_1fdcb90605084833b806b57952542840.pdf?index=true
- https://95e354e6-8561-4e52-807b-deb85f3b5fdd.filesusr.com/ugd/ca9b0a_f4003492b14d4ef0a554e3cb4586f449.pdf?index=true
- https://cd8fad78-6a19-43c6-878c-830d169ee42d.filesusr.com/ugd/ff0d91_579cec5ba6d24f38b015cb83303b318b.pdf?index=true
- https://02314edc-d025-420b-9d62-795437f25c47.filesusr.com/ugd/4f0fc1_ae34725c725446bb949ffb11b4c50e1a.pdf?index=true
- https://uploads.strikinglycdn.com/files/9ab12d6b-8272-48d6-8b66-fc180e2f3a4d/41664923012.pdf
- https://uploads.strikinglycdn.com/files/c81213bc-8893-4334-9f41-f9f1482d58f0/what_is_the_purpose_of_the_yield_arrow_in_a_chemical_equation.pdf
- https://uploads.strikinglycdn.com/files/7da578c2-1b2f-4fa5-ac7d-b884105a44b9/graco_breaze_click_connect_stroller_accessories.pdf
- http://rifufogasuser.rf.gd/d_link_access_point_configuration.pdf
- http://molumazorok.rf.gd/vamerazota.pdf
- https://uploads.strikinglycdn.com/files/84da0309-bb19-43b2-97cc-9260ca40570a/ps4_remote_control_tv_codes.pdf
- https://b9264059-5ce6-458a-812b-58b21e0c51d1.filesusr.com/ugd/9a3dc1_d5fe523ed4a84183bc41c2d772f20d1c.pdf?index=true
- https://uploads.strikinglycdn.com/files/cb747fe2-b716-4d3e-a796-0b4547875aca/avengers_endgame_final_battle.pdf
- https://uploads.strikinglycdn.com/files/990b5b23-a236-4cbf-adbe-94aabe41ebb0/what_is_the_best_diet_for_young_athletes.pdf
- https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_5a72c99fae834fd982d146e54e5397a8.pdf?index=true
- http://panadokopejed.epizy.com/cayman_islands_customs_and_immigration_forms.pdf
- https://b9387e75-0942-48a6-8a47-0bd3f0224277.filesusr.com/ugd/fc485c_58496a66abcc4b128b753c9e3179a665.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000100c0.bin` `bc9803d7ac3545d6161322643d2b8de58261a467e42c162a4ddfac7f8851ec35`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x100C0	5340 bytes
`font_01_sfnt_off0001130c.bin` `f393aa78d905fc8a4eebaf90f5d1e80bee253d0d7e6ee472817e1cc0c3f3c1b3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1130C	12380 bytes
`font_02_sfnt_off00013b60.bin` `ce218634269a132b492d861b6ec257309ec4c38c1a2398890e014d97e179373d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13B60	17772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.