PDF malware analysis — malicious · 7a64fcaeb8a959ad

MALICIOUS

PDF

91.5 KB Created: 2021-05-18 11:31:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10

MD5: 578239ab956d9bf1a8ce42d4b39692a0 SHA-1: 5a2aa537f6b7b715edfab35988e09c200b43c42d SHA-256: 7a64fcaeb8a959adeb12f8982b4640e6e9e74c04326521e8a9e2f90f527bc1b7

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier indicating maliciousness. The 'SE_MFA_LURE' heuristic suggests the document is designed to harvest credentials or abuse multi-factor authentication. The presence of a PDF link farm and an embedded URI pointing to 'vilenefex.ru' indicates a phishing or malware distribution attempt. No scripts were extracted, but the PDF structure itself is used to facilitate the malicious redirection.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
MFA / one-time-code harvesting lure high SE_MFA_LURE

Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/strik?utm_term=how+can+i+update+gb+whatsapp+on+my+phone PDF link annotation
- https://fadufavibog.weebly.com/uploads/1/3/4/8/134889314/3484682.pdfIn PDF document text
- https://ranazujip.weebly.com/uploads/1/3/5/3/135398887/vamepur.pdfIn PDF document text
- https://kadamoxezegawuf.weebly.com/uploads/1/3/4/3/134347408/dopevitamuxubileboz.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/dc1328c0-9c31-49db-a97d-07e5389ad14e/which_fitbit_to_track_sleep.pdfIn PDF document text
- https://s3.amazonaws.com/wovedukevikov/faithlife_study_bible_apk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2b5296f-d8ef-49d3-9ac6-faf5e1592133/lineamientos_del_consejo_de_participacion_social_2019.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/22d5508f-f50a-491f-92bf-5205a72e10ac/best_way_to_study_for_master_electrician_exam.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9610ff3a-e65d-49a1-95c3-61344ff9080e/2006_gmc_envoy_xl_engine_5.3_l_v8_denali.pdfIn PDF document text
- https://s3.amazonaws.com/mekonulegipero/lomawuritadidewekodesep.pdfIn PDF document text
- https://s3.amazonaws.com/zemigiduwagafu/simple_queen_platform_bed_plans.pdfIn PDF document text
- http://nuratijuwatag.rf.gd/antimicrobial_activity_of_ginger.pdfIn PDF document text
- https://s3.amazonaws.com/xufaxoferugod/duxiranolevifaki.pdfIn PDF document text
- http://bapadukaf.epizy.com/nazezigijesivifabamuxuk.pdfIn PDF document text
- http://gojuveri.rf.gd/david_ludwig_always_hungry.pdfIn PDF document text
- https://s3.amazonaws.com/xixonu/tejinopawagedeki.pdfIn PDF document text
- https://s3.amazonaws.com/minaxigevani/how_to_get_a_free_phone_with_metropcs.pdfIn PDF document text
- https://s3.amazonaws.com/fibesezati/24397451035.pdfIn PDF document text
- https://s3.amazonaws.com/tometubufimopim/1189329591.pdfIn PDF document text
- http://dikokek.epizy.com/21820873931.pdfIn PDF document text
- https://s3.amazonaws.com/wefadep/what_to_do_when_apple_tv_remote_wont_work.pdfIn PDF document text
- https://s3.amazonaws.com/nerugiraxura/46835664843.pdfIn PDF document text
- https://s3.amazonaws.com/towakog/libokiwixujunopiv.pdfIn PDF document text
- https://s3.amazonaws.com/voropa/114322484.pdfIn PDF document text
- https://s3.amazonaws.com/telasebisu/stephen_kings_it_drama_miniseries_cast.pdfIn PDF document text
- https://s3.amazonaws.com/gupawupigawono/android_studio_3._0_disable_instant_run.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000126a0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x126A0	5652 bytes
SHA-256: `2e5a5772ee8c7f26a388044faa12f3a9005b195f2082d406177d1f55d5021d6c`
`font_01_sfnt_off000139c9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x139C9	11296 bytes
SHA-256: `b60ea786b9aafffb5d5b3b15f90dbd5c6b52f6678fda4aab19b04336556766a3`

Open this report in the interactive analyzer, or submit your own file for analysis.