PDF malware analysis — malicious · 5288496900ddefb6

MALICIOUS

PDF

85.1 KB Created: 2021-03-15 03:23:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 337b4737176ead8360703bc74d7d9023 SHA-1: 3b5006178ac61fa4945b2386b6468c7ea9da2211 SHA-256: 5288496900ddefb6af7c89c3b26efe97837170df556cbe9a25e79383337a4ffb

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, many of which are part of a link farm designed to improve search engine rankings, as indicated by the PDF_SEO_LINK_FARM heuristic. One prominent link, https://lozipotod.ru/wix?keyword=manual+licencia+de+conducir+nj, suggests a lure related to driver's license manuals. The presence of the SE_PASSWORD_ARCHIVE_LURE heuristic indicates that the document may be instructing the user to open a password-protected archive, a common tactic to bypass gateway security. ClamAV also detected this file as Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0, confirming its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9950

Heuristics 6

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://lozipotod.ru/wix?keyword=manual+licencia+de+conducir+nj
- https://mojijunu.weebly.com/uploads/1/3/1/0/131070220/nuvafu.pdf
- http://sufulilutidake.mypressonline.com/linksys_ac1200_range_extender_2_pack.pdf
- https://vulodimov.weebly.com/uploads/1/3/4/8/134880101/2961833.pdf
- http://mihetos.xyz/7781473202747fqu.pdf
- https://limopepubev.weebly.com/uploads/1/3/4/6/134627214/2999888.pdf
- https://nakaporona.weebly.com/uploads/1/3/1/4/131438848/mavoxagavenevubade.pdf
- http://lezozopose.iblogger.org/information_security_policy_template_uk_2019.pdf
- http://fupemagis.mywebcommunity.org/huckleberry_finn_movie_cast_1993.pdf
- http://contact-git.top/electric_field_simulation_answers_brainlyat0m8.pdf
- http://beamorem.com/esc_guidelines_hypertrophic_cardiomyopathywa8ll.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/lezerawe/datasheet_inverter_sungrow_20kw.pdf
- http://nerezusilanake.atwebpages.com/best_resistance_bands_for_glutes_uk.pdf
- https://s3.amazonaws.com/gajakelegeza/pejafarabakagonova.pdf
- http://wiraxowofes.epizy.com/kujosepeb.pdf
- https://d920bd67-dfaf-4c99-85b0-fcb8118dfb91.filesusr.com/ugd/383849_17c16332cdab4a529564e6d0625d62b1.pdf?index=true
- https://s3.amazonaws.com/fotepopunaj/pejefofulevowij.pdf
- http://koriwironawuva.myartsonline.com/jeloxogajekepim.pdf
- https://06ebba1c-c738-45d4-b58d-83edbdcc9420.filesusr.com/ugd/b14caa_03752de788794d1086691fff392bc600.pdf?index=true
- https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_08572b8a75984e5182600521ac6aba49.pdf?index=true
- http://gozosowizopuk.rf.gd/duwikimuzizitojag.pdf
- https://921790ca-7b53-43bd-a25d-275d6f056404.filesusr.com/ugd/9d24cb_05cec1c9b83c453098d1660db6fff006.pdf?index=true
- http://nibopinalilabaj.onlinewebshop.net/59408515256.pdf
- https://s3.amazonaws.com/poguvelefa/27864254165.pdf
- https://s3.amazonaws.com/kukupunopedon/66747714957.pdf
- http://lusiromipu.epizy.com/nutuwuxonobupujofeb.pdf
- https://87164119-88a6-4d6d-a72f-b109cf2d88b9.filesusr.com/ugd/bd0a66_6037bbe4494b4522967e0e0810bb712d.pdf?index=true
- http://fukorow.epizy.com/xefalimapezad.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f8b1.bin` `3a04a9ffa903d45f867329bc5ebcd4acbcca0e3a3783664c667b3f457f55b376`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF8B1	4836 bytes
`font_01_sfnt_off0001093d.bin` `9434cc4a240586df5ff375f8596294dd3d313af16a6297d3ddf48e537b390c83`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1093D	11804 bytes
`font_02_sfnt_off00013005.bin` `6a5dfc981d356eea4ad6451552d91fc065f12d46107e44befce49e2a6a17f228`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13005	16344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.