PDF malware analysis — malicious · 606cd22b07aae27f

MALICIOUS

PDF

99.1 KB Created: 2021-04-15 17:03:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e236448c7813290eabbd58630e9913bd SHA-1: 2c9c074cc8c89727b75e614576370ec9c79f2660 SHA-256: 606cd22b07aae27fb47694f1007bf71e7e783798a5f4e6ed7b6180ba70c1069a

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are likely part of a link farm designed to obscure the true malicious destination. The primary malicious URL identified is jumiwimov.ru, which is presented in the context of a driver's license update. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jumiwimov.ru/strik?utm_term=nc+driver%2527s+license+update+address
- https://nuwukovodikala.weebly.com/uploads/1/3/4/6/134666266/024bdc5.pdf
- https://cdn.sqhk.co/xubipoxeguza/ib1uoxB/kekinezivitejositazi.pdf
- https://cdn.sqhk.co/wixedineve/jcFhhch/buxesesodojepeteguzuxu.pdf
- https://cdn.sqhk.co/pinofizulag/fhmNoqz/world_at_war_ww2_strategy_mmo_hack.pdf
- https://cdn.sqhk.co/satasevubu/hcQaid1/xatom.pdf
- https://rurasudi.weebly.com/uploads/1/3/4/4/134485231/kibugafeluzulosal.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/e01da1ca-0429-4e49-ba88-73f28712e1ae/the_road_cormac_mccarthy_book_cover.pdf
- https://eb72eaa1-ef55-40a3-a653-f6d21bccf295.filesusr.com/ugd/54913d_5ddeff6199ae44f2a641c1773849fe9c.pdf?index=true
- https://810dce77-56ab-4324-823a-3549757f4eab.filesusr.com/ugd/1fad07_4e00bd556013443ab2bec221245886c0.pdf?index=true
- https://s3.amazonaws.com/vifusupegiza/adverbs_of_time_and_frequency_worksheets.pdf
- https://uploads.strikinglycdn.com/files/5d3d7479-26ab-47ab-91aa-b566272b0a90/best_speakers_for_classical_music_reviews.pdf
- https://s3.amazonaws.com/tigovatolis/acer_chromebook_spin_15_reviews.pdf
- https://s3.amazonaws.com/bexolamabad/carnatic_music_songs_free.pdf
- https://uploads.strikinglycdn.com/files/2081ba12-2ad5-4e26-ac90-d2a746173c40/50037072687.pdf
- https://uploads.strikinglycdn.com/files/81b1083e-6e79-40c8-a7b9-84a588664c83/dosukujigoripot.pdf
- https://uploads.strikinglycdn.com/files/56b5f3ea-7969-4811-ae03-48b07855b02c/how_to_change_battery_in_microsoft_wireless_mouse_5000.pdf
- https://s3.amazonaws.com/nelizenejakarug/who_are_the_prime_ministers_of_canada.pdf
- https://45f0f727-c607-4398-b3b7-8b42e23b21b2.filesusr.com/ugd/0a84ca_0063f77e925542ad8c5ef2a94f64cbd1.pdf?index=true
- https://s3.amazonaws.com/genijusemu/anandi_vastu_calendar_2019_in_marathi.pdf
- https://s3.amazonaws.com/betefowubevat/acronis_disk_clone_free.pdf
- https://592f3795-292b-4eb7-bb82-ca7d83343d16.filesusr.com/ugd/44d997_ce88b6a28cc84472ba4bce3bf7082aff.pdf?index=true
- https://s3.amazonaws.com/fejififimaketo/tukuxunewujuvapijokutos.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000141a8.bin` `cf0aa93bb366be69d633518399b06e569ad3c3a0dfb81576c4b8f8cf992c2eca`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x141A8	5128 bytes
`font_01_sfnt_off00015337.bin` `f7d65716443a8f9b9e1977343ee7755bb0bd6098d3e2e5a2e23103ef8ee06c2e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15337	12388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.