PDF malware analysis — malicious · 72ae67f97a2e0cc4

MALICIOUS

PDF

77.7 KB Created: 2021-04-05 13:02:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: e1bf3c1eef6d2187a0a973b241768f9c SHA-1: e227e998fa07ea4f6233adee2b5a12a1bc2d7105 SHA-256: 72ae67f97a2e0cc4b3ac1291f378807d9d4e6400e736cf592529217156fb130c

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The sample is a PDF file flagged as malicious by ClamAV and an ML classifier. The 'SE_CLICKFIX' heuristic indicates social engineering, instructing the user to press Win+R or paste a command, which is a common tactic to bypass macro restrictions and execute arbitrary code. The PDF also contains numerous external links, including one pointing to 'http://maturibcgj.space/880389895389hyva.pdf', suggesting it acts as a downloader for a secondary payload. No scripts were extracted, but the overall behavior points to a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9991

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClickFix social engineering attack high SE_CLICKFIX

Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://baarspo.ru/wix?keyword=adobe+reader+dc+print+to+pdf+missing PDF link annotation
- http://maturibcgj.space/880389895389hyva.pdfIn PDF document text
- https://wisiwojapano.weebly.com/uploads/1/3/4/8/134896472/1305d68ed89.pdfIn PDF document text
- https://basupetuwesaf.weebly.com/uploads/1/3/0/7/130739706/disot.pdfIn PDF document text
- http://storeyou.store/mini_vci_for_toyota_tis_techstream_downloadpc6n5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4461232/normal_5fd21a361a747.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4466675/normal_5fe83eb1ccf1b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481059/normal_6063dfddab4ba.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379839/normal_60471da7941c1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4419857/normal_604152e09f5c3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368504/normal_600e5ea4e8794.pdfIn PDF document text
- http://nosinoski.shop/sofewumezagadelipijugs08g.pdfIn PDF document text
- https://bimefitovaj.weebly.com/uploads/1/3/1/4/131437299/fixidefag.pdfIn PDF document text
- http://reawont.online/suncast_auto_rewind_hose_reel_assembly_instructionsdcdz6.pdfIn PDF document text
- https://jutineriru.weebly.com/uploads/1/3/4/8/134866815/sexawigalulug.pdfIn PDF document text
- http://nyvelsets.online/96003366866oe5t4.pdfIn PDF document text
- https://nabinavupofi.weebly.com/uploads/1/3/5/3/135350319/2583771.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4483587/normal_5febd5b5e5557.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/liwafo/52142329807.pdfIn PDF document text
- https://s3.amazonaws.com/vidadaviwal/sapoluvusaxovikudixoleful.pdfIn PDF document text
- https://s3.amazonaws.com/godoremitiwuja/aisi_316.pdfIn PDF document text
- https://s3.amazonaws.com/penefelomiju/activetcl_8._3.pdfIn PDF document text
- https://s3.amazonaws.com/wifukedot/pepawuwarimadumeruk.pdfIn PDF document text
- https://s3.amazonaws.com/pezofut/67545412120.pdfIn PDF document text
- https://s3.amazonaws.com/topipovikapari/xivosesokekenat.pdfIn PDF document text
- https://s3.amazonaws.com/mixanaz/67345493846.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ef05.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEF05	5572 bytes
SHA-256: `e2af2a5b1e929fc381c83829355d27ea3c11937d5f62e0a0bc6b552a7c16ceb2`
`font_01_sfnt_off000101e1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x101E1	10960 bytes
SHA-256: `a06b87eb69ce2b3fac8d24b62a5083bbbf0b882af25b0d1189e0f120779132d2`

Open this report in the interactive analyzer, or submit your own file for analysis.