PDF malware analysis — malicious · 63c17699dbf58aae

MALICIOUS

PDF

80.9 KB Created: 2021-03-11 18:44:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25

MD5: 7ce4e12d6d8aca4094f52a3fa2d4deb0 SHA-1: d3e1aaf9a42f079e324a2116026626c9602f5c0d SHA-256: 63c17699dbf58aaed919da3510cb8d4a2526aa6bc95a40dfe89822d9f4f18635

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple external links, including one identified as an SEO redirector for phishing. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm for SEO manipulation or to distribute malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to lead the user to a phishing site or download further malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pelibifir.ru/wix?keyword=vudu+movies+missing+from+movies+anywhere PDF link annotation
- http://investmag.org/21364314361qpezs.pdfIn PDF document text
- https://cdn.sqhk.co/xurinuwame/hhjiqzq/blocky_highway_traffic_racing.pdfIn PDF document text
- https://cdn.sqhk.co/surofowudula/EidhfUI/village_farm_game_guide.pdfIn PDF document text
- http://aycotoro6.xyz/why_theory_of_computation_is_neededf7u2w.pdfIn PDF document text
- http://springital.fun/police_car_chase_crash_videos001ep.pdfIn PDF document text
- http://mnatural.space/dajutumiguxijipy0rfr.pdfIn PDF document text
- https://cdn.sqhk.co/nesuxozajek/iRjaicf/xcom_enemy_within_guide.pdfIn PDF document text
- https://cdn.sqhk.co/dixufeja/fgihfjd/amazon_advertising_success_stories.pdfIn PDF document text
- https://cdn.sqhk.co/merodobiweve/bidijmu/othello_character_development_essay.pdfIn PDF document text
- https://mitumeme.weebly.com/uploads/1/3/4/8/134879381/3542033.pdfIn PDF document text
- https://sonoxezepokamev.weebly.com/uploads/1/3/3/9/133999938/jofokej.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://02bc4616-4eae-4b38-b2c9-0e654f754ee0.filesusr.com/ugd/069df5_4d75ad25570a4016a210e8dd5f64b889.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tapelu/siwuruxutabuguvogi.pdfIn PDF document text
- https://s3.amazonaws.com/wesezuzuvalirik/jipegadusonexogatopepozet.pdfIn PDF document text
- https://s3.amazonaws.com/donake/binding_of_isaac_antibirth_cheat_sheet.pdfIn PDF document text
- https://s3.amazonaws.com/pasawexawinogad/adding_three_addends_worksheet.pdfIn PDF document text
- https://s3.amazonaws.com/wujapu/68350529656.pdfIn PDF document text
- https://s3.amazonaws.com/resabomibogodaw/pubelunujanuwurobuladowo.pdfIn PDF document text
- https://025b4bf0-2906-4f5f-8a0f-6d4b68fc9518.filesusr.com/ugd/148ee2_cc695fe6aaae418baa2c3d8669a2ea49.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jidosatikim/apowersoft_video_er_for_mac.pdfIn PDF document text
- https://s3.amazonaws.com/fezenur/kiluwaxogi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f07a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF07A	5308 bytes
SHA-256: `6fb742e29229fb166ab181ff0e2f593f5b168829abba8c546d4fff3a143ab461`
`font_01_sfnt_off0001026c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1026C	11176 bytes
SHA-256: `a8c36ea9ff12ca98058b3638518b98510175a2f119eaf935bffd1635cbe0b37e`
`font_02_sfnt_off00012830.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12830	4324 bytes
SHA-256: `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`

Open this report in the interactive analyzer, or submit your own file for analysis.