PDF malware analysis — malicious · 60e95821dd9c49ce

MALICIOUS

PDF

77.2 KB Created: 2021-03-05 00:35:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12

MD5: 2f2611ffa4b9a0a90d5a4d488d6d7c69 SHA-1: 7b0f648abaf9d727d59f25eefeeb9f88e54d9944 SHA-256: 60e95821dd9c49ce885c2bb78bf6e6eef56afa8ad487bcc0834e6d6e20793302

164 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The PDF contains a large number of external links, many of which are likely part of an SEO link farm, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The document body, though heavily obfuscated, suggests a lure related to literary analysis, which is likely a pretext to drive traffic to malicious or SEO-optimized URLs. No scripts were extracted, but the presence of numerous external links and the phishing/trojan detection strongly suggest a malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9993

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://zajinet.ru/award?keyword=taming+of+the+shrew+act+3+scene+2+analysis PDF link annotation
- https://garusase.weebly.com/uploads/1/3/4/6/134634063/81358c1159e.pdfIn PDF document text
- https://xekesaxi.weebly.com/uploads/1/3/4/3/134317917/vusemakowuw.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4495271/normal_5ffbef26bd0a4.pdfIn PDF document text
- https://kizinuraximi.weebly.com/uploads/1/3/4/4/134446503/712303.pdfIn PDF document text
- https://jeripakituwimug.weebly.com/uploads/1/3/2/6/132695489/574260.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420459/normal_5fdb2b35e7447.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453117/normal_5fd7a7688eaf7.pdfIn PDF document text
- https://dezirivudamowi.weebly.com/uploads/1/3/1/8/131856369/ruwujo-ligifoguvo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/puretulenuza/enterprise_architecture_diagram_visio_template.pdfIn PDF document text
- https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_944069c7890e41fdb79062fb176ce843.pdf?index=trueIn PDF document text
- https://69c5641f-197a-42c1-bef1-daa502c1f1d7.filesusr.com/ugd/948cea_d188d3de3cff4e4ebfeacb75a1d18265.pdf?index=trueIn PDF document text
- https://0fe83ef2-ed6b-4f04-a52d-31fe3c58d8d1.filesusr.com/ugd/ade4e6_12a38c91ba284981a1dd2371502ad078.pdf?index=trueIn PDF document text
- https://f6ce3cfb-f922-470c-9e0e-eaf724001b0e.filesusr.com/ugd/defcb2_cc94d440772745939127b5599cc6b304.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xipavir/45212513000.pdfIn PDF document text
- https://d25e5d79-f3dc-43ab-8538-58f2f4730235.filesusr.com/ugd/898300_89128734a71243f4a684e3afaf2f7bcb.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tuzamada/metformin_toxicity_lactic_acidosis.pdfIn PDF document text
- https://s3.amazonaws.com/jixerubowi/52216224885.pdfIn PDF document text
- https://s3.amazonaws.com/davawina/86513068760.pdfIn PDF document text
- https://84bd2c60-91d0-47b6-9565-6ae8a6593e58.filesusr.com/ugd/963627_157c7fe87bc24b56ab3564657a50e99f.pdf?index=trueIn PDF document text
- https://97d49ff2-d914-4ae4-8ac8-5e5cf5f77cad.filesusr.com/ugd/6350c7_7f79041345404992acc32dbdb9060630.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/baposivarabuj/63665905010.pdfIn PDF document text
- https://s3.amazonaws.com/xomudufe/zodagenu.pdfIn PDF document text
- https://s3.amazonaws.com/jubiferekaka/82451788490.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f13e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF13E	5732 bytes
SHA-256: `69fef958f94baacbf1e4de7959aaa058371eb5c4975a13b2d7b357df83fd6377`
`font_01_sfnt_off000104be.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x104BE	10164 bytes
SHA-256: `da3d0f6a89face88efa2ae63218c0afeab21e5a09538d1581921db3f58e34db3`

Open this report in the interactive analyzer, or submit your own file for analysis.