PDF malware analysis — malicious · 751060c52cf2d943

MALICIOUS

PDF

105.3 KB Created: 2021-03-25 06:10:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 75db03947fa9c9d571f86fa0966bafbb SHA-1: 7e4eefb2d34486cec4e3099dea40c6ced3047ae0 SHA-256: 751060c52cf2d9437fffd78955a4882b6e56f207945ba341c8e47513747091f5

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document contains numerous external links, with a primary focus on directing users to 'vilenefex.ru' under the guise of search results for 'brutal.io unblocked games 66'. This suggests a phishing or scam attempt designed to redirect users to potentially harmful content.

Machine Learning

Nyx PDF Classifier malicious score 0.9873

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/wix?keyword=brutal.io+unblocked+games+66
- https://zodutobaziji.weebly.com/uploads/1/3/1/4/131408241/gagujosevewibep.pdf
- https://puzifisabu.weebly.com/uploads/1/3/1/3/131378936/wiwebofixisifuz.pdf
- https://fagedudadisex.weebly.com/uploads/1/3/0/8/130874641/telizu.pdf
- https://nimuneroz.weebly.com/uploads/1/3/1/4/131407882/rolepugupewetog-mukufidiposu.pdf
- http://bojatutafovira.iblogger.org/kusiliga.pdf
- https://static.s123-cdn-static.com/uploads/4450145/normal_5fcc37b96acac.pdf
- https://dafizoxov.weebly.com/uploads/1/3/5/3/135309439/7713236.pdf
- https://vabakapis.weebly.com/uploads/1/3/1/4/131453405/52162ce7c8d1513.pdf
- https://vuderuxedus.weebly.com/uploads/1/3/4/6/134692959/fisusufixusuxefu.pdf
- https://static.s123-cdn-static.com/uploads/4490244/normal_5fe2f62706e44.pdf
- http://zorebagexibakom.22web.org/life_saving_appliances.pdf
- https://pevaluxuduta.weebly.com/uploads/1/3/4/5/134502983/lumav.pdf
- https://cdn-cms.f-static.net/uploads/4490252/normal_60225ec287cc2.pdf
- https://static.s123-cdn-static.com/uploads/4417653/normal_5fe431f344c1b.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://02bc4616-4eae-4b38-b2c9-0e654f754ee0.filesusr.com/ugd/069df5_ff13b76c8c934927a539986493d9c0cd.pdf?index=true
- http://zajukefed.epizy.com/bollywood_song_dj_video.pdf
- https://7915398d-c9c2-4241-abdb-40cf742e4b8d.filesusr.com/ugd/d4df0f_9efd8819d13a429aacecc8d50393df1a.pdf?index=true
- https://1f49b3f1-4b09-4f89-88df-03804352fc9a.filesusr.com/ugd/a51aec_5785db1ea1634bc1818168e505fbdd58.pdf?index=true
- https://aabf49e0-5477-4fd2-8456-a986ef8f2a87.filesusr.com/ugd/9e14ca_4a62fde4185141a0aa73bff675d60c1a.pdf?index=true
- https://7fd4abad-31f8-4c52-ae8e-93d0cc7f2af2.filesusr.com/ugd/910e70_af1f6cd61b8f4f50a6537dbc4f9f5cc3.pdf?index=true
- https://9c43cb74-45e3-47de-9527-fda2e8336169.filesusr.com/ugd/af0aa9_a95b7af5660f442b945e9712f11d8941.pdf?index=true
- https://ac4cd5cf-e861-4b1b-a585-e47049f737a6.filesusr.com/ugd/843280_afb0d292b19a44a5af628f4906841a22.pdf?index=true
- https://95fbbc11-640f-4658-acdf-6e09da746871.filesusr.com/ugd/e42ee3_f0d193f1e9ff4cd3aeb71eedc8eea208.pdf?index=true
- https://34886cf3-15ed-44db-93e8-8979dc7c4cd7.filesusr.com/ugd/ea2c45_237722ec2f134a9dadda12db0e550ba3.pdf?index=true
- https://3176e400-c268-4dc0-8d69-08eae86937f8.filesusr.com/ugd/ea2f88_3c78ffeb59bb465487aa76438964a417.pdf?index=true
- http://bodudubabafixe.rf.gd/barry_callebaut_ag_annual_report.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000123e1.bin` `06eac510d9c6914fc4afc0460a406e9a35c312d3b4813089adf1ff341c36f5b7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x123E1	4276 bytes
`font_01_sfnt_off00013302.bin` `2ccc81c81189b28e8fb7c047ba031b9b7a53a3517a5943242762737941be1ee6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13302	5580 bytes
`font_02_sfnt_off000145dd.bin` `d4c0f6a392f4bbe9a947545a6fd269abfc69faae008bb142086db4b0ea406b65`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x145DD	11624 bytes
`font_03_sfnt_off00016cdb.bin` `051eeface2f1f4fb555e87bc3d9be0cc140ad700c15cfc32705c90a240907b2c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16CDB	18032 bytes
`font_04_sfnt_off00018877.bin` `d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x18877	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.