PDF malware analysis — malicious · 6ea8acd498213fa5

MALICIOUS

PDF

93.9 KB Created: 2021-03-17 05:16:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: eb7ab28877ab06154246d1a8ff5a45c6 SHA-1: 8793adbd84d0b9ed3ab04646135d0281831d8255 SHA-256: 6ea8acd498213fa57e86cc74c37fce4f754e06bf2502d436f85fd07f1ec86f90

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/award?keyword=ccna+pdf+book+bangla PDF link annotation
- https://static.s123-cdn-static.com/uploads/4413473/normal_5fce76ffc3b5a.pdfIn PDF document text
- http://nekidifuton.medianewsonline.com/treatment_of_myocardial_infarction.pdfIn PDF document text
- http://metoxegid.mygamesonline.org/how_to_access_asus_router_configuration.pdfIn PDF document text
- http://nipokaxa.getenjoyment.net/xatonukedelivomun.pdfIn PDF document text
- http://guzexesuge.mypressonline.com/wedise.pdfIn PDF document text
- http://pugezesiw.mygamesonline.org/harry_potter_house_trunk_book_set.pdfIn PDF document text
- http://fidofawi.medianewsonline.com/30132431156.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468268/normal_5fe7f6dcf261d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365549/normal_602d031af005e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4457570/normal_5fe1b9bfb09f4.pdfIn PDF document text
- http://mukinumatonewo.getenjoyment.net/xurez.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4426063/normal_5fec49df5cc5c.pdfIn PDF document text
- http://pemufosapakem.mypressonline.com/organic_chemistry_class_12.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/waxapoz/siemens_plc_software.pdfIn PDF document text
- https://s3.amazonaws.com/dosipive/48597906961.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/20d05b71-5177-4abb-912f-ed035c93f785/sims_3_free_expansion_packs_origin.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d8bcbed0-0c6e-4b99-9205-66035d072a1e/honeywell_quietset_tower_fan_replacement_remote.pdfIn PDF document text
- http://gozenabuzixi.onlinewebshop.net/19052197705.pdfIn PDF document text
- https://s3.amazonaws.com/zamemigojat/codehs_answers_1._10._5.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7dddf2bb-bbc6-437a-bd2a-467596f2089b/16454266691.pdfIn PDF document text
- https://s3.amazonaws.com/voxulija/springer_journal_template_word_2016.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
- http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f06e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF06E	5160 bytes
SHA-256: `718323cd44826d5694a8abb44870cc02b60016652fc0a0ea725e573808420c55`
`font_01_sfnt_off00010215.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10215	22252 bytes
SHA-256: `3bb106fbc6cd1c00ffdab37b0b185901c146d4aaec72bcf411ec804f27eb4103`
`font_02_sfnt_off000141aa.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x141AA	11036 bytes
SHA-256: `c67a7a19e7ae65a0ab66e192fa0fafe50cb040b95a7f35e383c619a1671d3968`

Open this report in the interactive analyzer, or submit your own file for analysis.