PDF malware analysis — malicious · 508fa6980a2577c5

MALICIOUS

PDF

82.0 KB Created: 2021-06-10 09:26:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 8e6d30e60306dcda1cc308a13f5febca SHA-1: c46401134a522fe8a8e8c3b28f288907f4076500 SHA-256: 508fa6980a2577c5bd74904e2c7a44d7ea94dfa77023a33a83489ee5e31961ca

166 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

This PDF file was detected as malicious by ClamAV and an ML classifier. The heuristic 'SE_CLIPBOARD_COMMAND_LURE' indicates the document instructs the user to copy and paste content into a shell, a common technique for executing malicious commands. The presence of numerous external URLs, including one pointing to 'nomylo.ru', suggests a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nomylo.ru/pbw?utm_term=bootable+installer+mac PDF link annotation
- https://bexepusukanuv.weebly.com/uploads/1/3/4/7/134775428/cd2c1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368962/normal_60b9448b98d9c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372721/normal_604b8027d7bec.pdfIn PDF document text
- https://xugowapowafav.weebly.com/uploads/1/3/0/7/130775127/losomeveligitad.pdfIn PDF document text
- https://giwakatunu.weebly.com/uploads/1/3/1/4/131437107/midufawak_nakumi.pdfIn PDF document text
- https://static.s123-cdn-static-d.com/uploads/4459926/normal_60b3ec5ae3bc6.pdfIn PDF document text
- https://demuvejujewik.weebly.com/uploads/1/3/4/0/134042515/5712365.pdfIn PDF document text
- https://jajozopikikaju.weebly.com/uploads/1/3/4/3/134359408/9152789.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4470029/normal_6004b7e15f665.pdfIn PDF document text
- https://japozinoju.weebly.com/uploads/1/3/4/8/134847937/batej.pdfIn PDF document text
- http://www.typoland.com/http://www.typoland.com/designers/Lukasz_Dziedzic/CopyrightIn PDF document text
- http://www.typoland.com/In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://wiwedano.pbworks.com/w/file/fetch/144590325/kiwi_fruit_nutrition_data.pdfIn PDF document text
- http://gudotoxej.pbworks.com/w/file/fetch/144497508/41889528473.pdfIn PDF document text
- http://kosubufegu.pbworks.com/w/file/fetch/145010481/fipegofedinumu.pdfIn PDF document text
- http://wotasaful.pbworks.com/w/file/fetch/144805263/wuxavafu.pdfIn PDF document text
- http://vakerul.pbworks.com/f/37578537981.pdfIn PDF document text
- http://negipidini.pbworks.com/f/66765852681.pdfIn PDF document text
- http://gezebal.pbworks.com/w/file/fetch/144935067/free_manual_vpn_configuration_for_iphone.pdfIn PDF document text
- http://mulasamesi.pbworks.com/f/fidoduxuxoxerugiwinezak.pdfIn PDF document text
- http://xodelow.pbworks.com/w/file/fetch/144451701/begezajaba.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000de69.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDE69	6168 bytes
SHA-256: `50bd8db5ff9a0f03ea6ac0366ab4ff273dceb6ff0c6101ac0faff1fd52ccc92d`
`font_01_sfnt_off0000ee0b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEE0B	5132 bytes
SHA-256: `29bac244fa7dd6f74f8ad66866d28fd8c48d3404f3de462a4b1655e12c50aea4`
`font_02_sfnt_off0000ff67.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFF67	11156 bytes
SHA-256: `41bda4e7b74025a5c59ec9f5bd071fa7133f958f0cd2254a2dcdccd18d8884d3`
`font_03_sfnt_off00012551.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12551	16092 bytes
SHA-256: `02d633d18b4efb222d06cb19cffeedd67924a627ef45dadcb57719ff17a75919`

Open this report in the interactive analyzer, or submit your own file for analysis.