PDF malware analysis — malicious · 6af37ea656d8bf2f

MALICIOUS

PDF

76.3 KB Created: 2021-03-16 21:45:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 22f44e638f5b017aa47b2d5370d2480e SHA-1: 17c20cef634fb19e16ed82fa9368c9e52adc9a89 SHA-256: 6af37ea656d8bf2f98e1374d758a5e3d5cc69012dc175a1d276ad5bc34712568

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, with one heuristic specifically flagging it as a 'PDF_SEO_LINK_FARM'. The primary external URL, 'https://leonvi.ru/award?keyword=basic+english+grammar+exercises+for+beginners+pdf', suggests a lure related to educational content, while another linked PDF from 's3.amazonaws.com' is also present. The document body is heavily obfuscated, preventing a clear understanding of its direct content, but the heuristics strongly suggest a malicious intent related to link farming or hosting further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://leonvi.ru/award?keyword=basic+english+grammar+exercises+for+beginners+pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/dukexajuj/frosty_the_snowman_2020.pdf
- https://bdee3e82-1fe6-4084-b289-f15f5249f83e.filesusr.com/ugd/749937_1ffe19f2ebbd4e058866a7c1698d1f99.pdf?index=true
- https://8cff94d3-ecab-4ea5-ad27-d3e67d02fd32.filesusr.com/ugd/2813e2_3a266d614105457a97d531d6d46e1a28.pdf?index=true
- https://s3.amazonaws.com/liwafo/tezaken.pdf
- https://s3.amazonaws.com/papuja/lodagoserinofiviwoton.pdf
- https://2d2b1dae-c014-4902-97e6-c3f1d56915cd.filesusr.com/ugd/70e5f7_7a52f3c3c7d64a1694f5be376e7f3790.pdf?index=true
- https://7ed754b6-a209-4558-9281-0032c7ee8ade.filesusr.com/ugd/4329d7_8a36277d7de04dec8593cc16f09bbb4f.pdf?index=true
- https://s3.amazonaws.com/xopugup/wetikizadumumasowige.pdf
- https://507f79ed-2408-4027-b124-45ed49bded7d.filesusr.com/ugd/2de61b_81df4454f5474682b3a2c5035bc8101a.pdf?index=true
- https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_424d88adebce4a489629086da64e322b.pdf?index=true
- https://uploads.strikinglycdn.com/files/c83283fc-701c-4e22-9a96-cb3953770cf1/inateck_1d_usb_barcode_scanner.pdf
- https://uploads.strikinglycdn.com/files/ae2f1b54-28f0-47fd-8da7-9104d519ef27/auld_lang_syne_piano_chords_for_beginners.pdf
- https://s3.amazonaws.com/regegozumekoza/android_change_back_icon_in_actionbar.pdf
- https://uploads.strikinglycdn.com/files/baed8ba1-7601-4f4b-a7e9-d2efc7e9b4e9/how_to_use_jam_double_chill_speaker.pdf
- https://uploads.strikinglycdn.com/files/5af7a2ae-7f49-4839-a75a-174b186d615d/what_is_the_density_of_the_unknown_liquid_mastering_physics.pdf
- https://645c32c3-7e99-4959-b93b-7980205539d7.filesusr.com/ugd/30a31c_8a2af031c9f14998ac3253d4584b1d5a.pdf?index=true
- https://uploads.strikinglycdn.com/files/1b6679f8-00c2-4b57-9226-ecb341eb2c78/why_does_my_water_softener_not_work.pdf
- https://s3.amazonaws.com/mexesazaxasa/85015241695.pdf
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d230.bin` `2603c3ad1a2858dec0394fa8f7eec23246e70298a34115379b1e61aea3c7edf8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD230	5824 bytes
`font_01_sfnt_off0000e5cf.bin` `145221cabc2cd2ccba74deb3953ae5503754f1434333b9a87b88d9d5dd338e5b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE5CF	1832 bytes
`font_02_sfnt_off0000eeaa.bin` `d1d0b3fa3fd3901948fbc561d07e973ce0eff56e82e66830a7856715d443da69`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEEAA	10832 bytes
`font_03_sfnt_off000113dd.bin` `d525ec757c27fd4f0f01407c814cabcefc53c4c3f117e50a2e9e37faa1a15c3f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x113DD	16508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.