PDF malware analysis — malicious · 52fcaa8e4cb73284

MALICIOUS

PDF

101.8 KB Created: 2021-05-30 22:09:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: 36166027e379e6fbbcb88e6c9dcb34d2 SHA-1: 8f091374423dd1ecf00da13bda86f38566f27658 SHA-256: 52fcaa8e4cb73284b70b0defa23c79c51cac7219112ddf83f12df3cf0f483a7d

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and a machine learning classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document contains a large number of external links, with the primary URL being 'https://fokemale.ru/123?utm_term=cerwin+vega+box+design'. This pattern is often used to manipulate search engine results or to redirect users to malicious websites. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fokemale.ru/123?utm_term=cerwin+vega+box+design PDF link annotation
- https://cdn-cms.f-static.net/uploads/4454163/normal_60330db058f37.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4501360/normal_5ffca969c7b8b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4404296/normal_60204daa12bf6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365570/normal_601bd1d06be85.pdfIn PDF document text
- https://sasasazar.weebly.com/uploads/1/3/1/3/131383954/f716d07e30832.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470232/normal_60201a33f1593.pdfIn PDF document text
- https://bimufoju.weebly.com/uploads/1/3/4/3/134311804/2736742.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4410986/normal_5fe39a2d0b380.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4461495/normal_5ffc314391512.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/7a8340f4-da8e-455d-8527-5e24ade52a3b/dabixerufaputevulukudotud.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/586ea29f-9b03-4ea4-be5b-5ac81103c194/79239176532.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6a840adf-bd16-488d-bca5-c04314a46568/linda_goodman_books_astrology.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fea5da60-225f-4c2f-bbc8-96860fa1a158/10901460606.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/10ac1945-e660-43cc-a0ad-ba02576fc2a3/33143352251.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5f77d1f5-a19c-4ea8-ab53-58ec9ffd071b/96420902876.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6c0797a6-3d05-404a-b606-73d1bb15d491/tegoresuposotu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb05b4bf-f1a2-49d9-9a18-757c40a5d35b/dantes_inferno_room_beetlejuice.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e90a5578-f20f-452d-bc5e-f87ab48f4193/el_monje_que_vendio_su_ferrari_slideshare.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dbb9fa16-0eb0-4281-bd60-6f537abda09a/verb_list_english_to_hindi_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d81c7875-f8a4-4232-9db3-0a9a1f094fc0/the_rainbow_fish_by_marcus_pfister_summary.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000135f7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x135F7	5228 bytes
SHA-256: `259cca2360476eec63fc74ba424c1062dc4a538a637f689377399f6737c2e82e`
`font_01_sfnt_off000147de.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x147DE	11688 bytes
SHA-256: `c316d1b0f9a97da165a117646fa54ad6a01ba5c82b562812022c0b44187128a0`
`font_02_sfnt_off00016f92.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16F92	17704 bytes
SHA-256: `fbb4956d300a2bc1609a147253032784f65f780f7e83b06b3c79c00a788569c1`

Open this report in the interactive analyzer, or submit your own file for analysis.