PDF malware analysis — malicious · 5d1c36d9f7d7e3b2

MALICIOUS

PDF

76.7 KB Created: 2021-03-22 04:23:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: be55227d5dbfd0a93102e94e24c4a216 SHA-1: e6da4aad0ee6126d40140c4cb939ce40b569b09b SHA-256: 5d1c36d9f7d7e3b2061ef45085a08e31af95a351862fa7bc2bf5c484b88c8c36

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent URL leading to a domain associated with phishing and malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create documents for SEO link farms or phishing lures.

Machine Learning

Nyx PDF Classifier malicious score 0.9988

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ponafet.ru/award?keyword=calendario+2020+pdf+da+stampare
- http://ita-fitness.fun/bloons_td_6_mod_apk_xpbl2s1.pdf
- http://espaceabonne.com/42702771087xoayc.pdf
- http://orbitan.fun/4203877353s9v8x.pdf
- http://7lessons.site/foxuwojupovezisebebwnfv5.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://e590c0d9-b694-44fb-9862-47327b30d8b0.filesusr.com/ugd/89363e_52aaddf565c34b078c7b67192c52caf2.pdf?index=true
- https://5f98d79b-b704-4ecc-a618-200e52db7f79.filesusr.com/ugd/d1a5b7_099c384eee294f3cb9671514cc044f87.pdf?index=true
- https://b2bd4247-5771-4f9a-9f3f-b46500bff287.filesusr.com/ugd/f41bfe_b7395e05cc4c48509f18c8668a1d426a.pdf?index=true
- https://uploads.strikinglycdn.com/files/04297480-a2dc-4b11-bbdb-082fe765b39e/nelefupusuburekixoralol.pdf
- https://uploads.strikinglycdn.com/files/10646344-2981-4e21-8196-759649185e72/76918046087.pdf
- https://f405dec1-7f90-4f4c-a861-5286f67d0127.filesusr.com/ugd/ab922d_2184817c8182411eb8dc0ebac824273b.pdf?index=true
- https://uploads.strikinglycdn.com/files/a561a2f8-c868-4044-b2e4-212c6fdb1912/presto_pressure_cooker_gauge_not_working.pdf
- https://uploads.strikinglycdn.com/files/cf21ab14-3469-42c0-8c6f-fa30037f3c43/harry_potter_book_order_uk.pdf
- https://uploads.strikinglycdn.com/files/d3e8c348-74ad-4a34-a540-d7689b9cc83b/delete_google_search_history_iphone_7.pdf
- https://5613ab86-cfe5-4642-b9e1-29ab5e510d76.filesusr.com/ugd/79e000_e7dd252857374164a06ce0e6b1905bb6.pdf?index=true
- https://8ecf7690-1f99-4e28-a4b6-3228ba9731d7.filesusr.com/ugd/63d3ad_55fc3916c8d0476084596cacbde929e7.pdf?index=true
- https://ff5ab256-a407-4697-91b9-141751226614.filesusr.com/ugd/4205e4_c038e5b6ad854a3ca649e2fe25510545.pdf?index=true
- https://c3e780e1-a1ee-422e-80b3-2bf79490ff1e.filesusr.com/ugd/dc7b26_48f2ca3ded7a45fe84da5c507c094121.pdf?index=true
- https://3e3188f7-d9e9-48da-9af6-4e6760718ee0.filesusr.com/ugd/4f7562_205ead6ac18f4222ae596f05650ed46c.pdf?index=true
- https://4edd92ed-4e96-4c3d-a837-a16c7246ae9e.filesusr.com/ugd/7c3149_7d038404040d4ecdae219b7559345368.pdf?index=true
- https://uploads.strikinglycdn.com/files/bf5e4f06-57bc-4f20-92a3-5e7e7fc44671/how_to_fix_recliner_seat_springs.pdf
- https://3cd6846c-369c-4875-9c63-132df726a2dd.filesusr.com/ugd/7ab50f_f7c1357b22f64d9f9927396c7bd8597b.pdf?index=true
- https://uploads.strikinglycdn.com/files/89206221-06f8-4422-afc7-bc4f120fd08c/pogapabuwiligi.pdf
- https://6b2f37ea-3696-4b87-858b-663c379f6f6f.filesusr.com/ugd/16879a_883c01cbe39d4cb9bc62838e8b2ad96b.pdf?index=true
- https://d6aab468-caab-4d9e-910f-d3bf64ae4104.filesusr.com/ugd/5438e3_199aca76ae4c4cc0ab5b228ce6153b9b.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e0c4.bin` `762f04d484ab8d30a589aa5373ec419695b7dfae28d846875ed1a741196f65bb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE0C4	5272 bytes
`font_01_sfnt_off0000f291.bin` `ac628fb48201cda1d32a0f5b06a489c6d7517b33d94fef35deaea3c6dce4a611`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF291	11076 bytes
`font_02_sfnt_off000116a3.bin` `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x116A3	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.