PDF malware analysis — malicious · 7436ad806e7abc8c

MALICIOUS

PDF

100.2 KB Created: 2021-04-02 07:45:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10

MD5: 5d9b95e2739144a7ec411dd022290269 SHA-1: 4d9373277f702f5467e7e50042acd7749343262b SHA-256: 7436ad806e7abc8c0f52ffc8746316e81826e12caa8ff780c05ea45ee9dae2f7

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, suggesting a link farm or phishing attempt, with one prominent URL being https://nipisod.ru/award?keyword=architektura+baroku+pdf. The document body is heavily obfuscated and appears to be generated content, further supporting a malicious purpose.

Machine Learning

Nyx PDF Classifier malicious score 0.9989

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/award?keyword=architektura+baroku+pdf PDF link annotation
- http://kernig.pro/10419774119qxqbo.pdfIn PDF document text
- https://zemizipip.weebly.com/uploads/1/3/4/0/134098502/abbefc6e1ee0.pdfIn PDF document text
- https://tatunuzaxu.weebly.com/uploads/1/3/4/5/134596213/nolinamekirijo.pdfIn PDF document text
- http://soldatskaya6.ru/tegaxukuleteoqc28.pdfIn PDF document text
- https://wawogikaso.weebly.com/uploads/1/3/4/7/134726687/1d2d3.pdfIn PDF document text
- https://tibufidis.weebly.com/uploads/1/3/0/7/130740046/51c5b015aefe.pdfIn PDF document text
- https://fudolimag.weebly.com/uploads/1/3/4/5/134586879/2a07c61cf2.pdfIn PDF document text
- http://homearfes.com/jiwajuihbp9.pdfIn PDF document text
- https://kasipuxatupar.weebly.com/uploads/1/3/5/9/135966953/tazuxujerivitu.pdfIn PDF document text
- http://bufo.online/crossfit_strength_training_programsce948.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://f039f7e9-c7fa-441d-bf3d-2f0e35d6be10.filesusr.com/ugd/80685d_a8996f962f454bc3b1e73b19f35a66a7.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zibenoroduzuw/pajanusonob.pdfIn PDF document text
- https://s3.amazonaws.com/pivetuzadujo/81276624822.pdfIn PDF document text
- https://s3.amazonaws.com/fezenur/film_worksheet_raging_planet_hurricane_answers.pdfIn PDF document text
- https://1c8fadd7-09eb-4d2b-9d42-8e747ba5ce52.filesusr.com/ugd/60625b_5f605c0979da4908a61159096bcadc3e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kagedatabujo/taotao_110cc_atv_ignition_switch.pdfIn PDF document text
- https://45dcde1a-aed5-4138-b95e-a0f768a283bf.filesusr.com/ugd/89441e_6c37de5a5523462bbc4450f0fe57e468.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/widuxade/codehs_javascript_control_structures_answers.pdfIn PDF document text
- https://s3.amazonaws.com/lopadivupudexa/nkjv_bible_large_print_amazon.pdfIn PDF document text
- https://e055bcc9-c4f1-4c6c-8dcb-0912bf54750f.filesusr.com/ugd/b4a829_09b7fc0b0708406f9d68c0ee16c663f3.pdf?index=trueIn PDF document text
- https://1ac5d900-0c69-4f12-8b1d-4e209472b8d2.filesusr.com/ugd/828753_8f20337284ec4adb93b492a03ba09681.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/firigugixujotov/vokasumukamukifitore.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00012673.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12673	5000 bytes
SHA-256: `a5f7c896873f56f7d4db801290031555f70fd7eab67e27e9ecf31671f4068e57`
`font_01_sfnt_off0001377e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1377E	12548 bytes
SHA-256: `6d73f05279ba10aacc62d51a2439533778eb6b086a2419cedd0314aadca9ca8f`
`font_02_sfnt_off00015eba.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15EBA	16060 bytes
SHA-256: `99ddc6f5858eb134f8024171ebe717cbd02485c31471b921a5021903b5272953`
`font_03_sfnt_off00017354.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17354	4324 bytes
SHA-256: `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`

Open this report in the interactive analyzer, or submit your own file for analysis.