PDF malware analysis — malicious · 746d6b32c18c417b

MALICIOUS

PDF

114.9 KB Created: 2021-03-10 13:55:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: bd72482224e1f609995b79071ebd2bbe SHA-1: 9083de5aec3abfcb0c92f839f17ce164041e7fc9 SHA-256: 746d6b32c18c417b7377867378fd661e1c8ef9302c67b2bf18addccca6364961

204 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing lure, specifically a browser extension or update installation scam. It also contains a mass external link farm, with one prominent URL pointing to a suspicious domain. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to trick users into downloading a payload or revealing credentials.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ponafet.ru/strik?utm_term=where+is+page+number+format+in+word PDF link annotation
- https://cdn-cms.f-static.net/uploads/4486365/normal_602d7a1dc8dc6.pdfIn PDF document text
- https://monijakuxit.weebly.com/uploads/1/3/4/3/134362478/fitulinobuxawi.pdfIn PDF document text
- https://beziremisolexew.weebly.com/uploads/1/3/4/6/134656792/fc0d650c26.pdfIn PDF document text
- https://doritader.weebly.com/uploads/1/3/4/8/134885844/jinoruzukasavabeto.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367294/normal_602f6da14a8af.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/02f8cf4a-f6d6-4fab-bdef-c5dee66ea247/famot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9bf7332f-8243-44ab-b7ca-fd58c59b428d/19815424926.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9269d745-5c68-4e6b-a4c8-09882f462538/beriponupovelivip.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d7db578-c445-428d-9461-761b95db2b15/mapa_de_riesgo_covid_mexico.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c5344f99-82e6-4e3f-b448-6f6ff8f8f627/toyota_rav4_fuel_mileage_2014.pdfIn PDF document text
- https://5e024257-ca51-40df-b6b5-a3104c7b7124.filesusr.com/ugd/97368a_ab7b35dfd04745cda97924cac8e8637d.pdf?index=trueIn PDF document text
- https://36622f5a-5a1b-41a5-aa98-965156e47ac2.filesusr.com/ugd/804ff6_596552b774a34327bba3140929118755.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a3ccdf0d-20a9-4afb-8211-e04bace1accf/ncert_class_5_maths_workbook_solutions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fe6d61ff-87be-47f4-974e-0588afe678cd/nedoduzilemo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/04b4d365-9b09-4d9e-a141-e44571f2280b/what_is_sickling_of_the_foot_mean.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ebc6fae7-8b9b-4169-a7a7-10b258d17d7f/18413706291.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/38486695-6dbd-4d58-81d8-cc8d8fef6fd0/19046222462.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00017662.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17662	5552 bytes
SHA-256: `935e0896e1726608b8db6fb4876336313f1d19e1283d7fe93b88595ebeb0c8aa`
`font_01_sfnt_off00018923.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x18923	11488 bytes
SHA-256: `6e02e18c0ffab7baed101b151b9698ecd1eca7f4e9817efc5bc8427a78c9332e`
`font_02_sfnt_off0001b05a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1B05A	4324 bytes
SHA-256: `0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333`

Open this report in the interactive analyzer, or submit your own file for analysis.