PDF malware analysis — malicious · 824fbe22645d70cd

MALICIOUS

PDF

115.7 KB Created: 2021-03-30 03:35:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 01858ac72880a2f8e92e83617708db0a SHA-1: e99e5cc993b96ea9f373419000d9c9c3469d61e5 SHA-256: 824fbe22645d70cdba1ed288201aa4f3231e136f66bf61a98860f8ef866cb772

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including PDF_SEO_LINK_FARM and CLAMAV_DETECTION, indicating malicious intent. The embedded URLs suggest a phishing or SEO-based malicious link farm attack. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9981

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/award?keyword=control+de+calidad+total+pdf PDF link annotation
- https://pejilajapife.weebly.com/uploads/1/3/4/4/134477767/moxosorusidifigetib.pdfIn PDF document text
- http://dkblogin-de.best/466064415033uwn4.pdfIn PDF document text
- https://fiwisito.weebly.com/uploads/1/3/4/7/134715438/zulakor_divujaz.pdfIn PDF document text
- http://topmassage.net/imagenes_bmp_de_24_bits_para_ciber_controlph6cy.pdfIn PDF document text
- https://donibirumot.weebly.com/uploads/1/3/4/4/134463545/subepedujub-xaraxivadadari.pdfIn PDF document text
- https://foxejakepi.weebly.com/uploads/1/3/0/8/130874264/5646999.pdfIn PDF document text
- http://sokolov.fun/pressure_washer_pumpb6okq.pdfIn PDF document text
- https://boxatikavizag.weebly.com/uploads/1/3/4/6/134680825/2004247.pdfIn PDF document text
- https://zamosokajuzosa.weebly.com/uploads/1/3/4/6/134651904/2741355.pdfIn PDF document text
- https://rabuwamefikulo.weebly.com/uploads/1/3/1/3/131398373/wiwiduzagir.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://aed022ca-8a9d-452d-9022-56a74a585a14.filesusr.com/ugd/4d548e_1988b251b159458782ddba2abbb9dd7a.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/gorajikunobixi/suvibexunulesenu.pdfIn PDF document text
- https://8717ace1-8174-44a1-9f98-e7cbf9e9ed94.filesusr.com/ugd/14e3be_28eabf122c074c03871203cb25a6cbbe.pdf?index=trueIn PDF document text
- https://9eb5ee95-128e-4115-bcd6-d8db8525ce49.filesusr.com/ugd/9904c2_abb0f2ef008c4746a26063857df9b437.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tarizirefevifab/p_m_l_a_full_form.pdfIn PDF document text
- https://b01ec662-dec5-4f54-b977-8708717d6054.filesusr.com/ugd/07e02c_e2355c8971174c4abb90b4312cbe9bc5.pdf?index=trueIn PDF document text
- https://068ba8bc-08b0-4b68-8151-f3c59c7a5775.filesusr.com/ugd/5a4aad_00387b9ee3864e4981046df575e0c123.pdf?index=trueIn PDF document text
- https://e29a9437-b0a5-48a6-9afa-908397ce514a.filesusr.com/ugd/16a9c1_fe7a3b6597104f5f8f96147c8385f9ce.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/dudigonifu/fable_3_hero_weapons_guide.pdfIn PDF document text
- https://a1359116-1358-4cde-afc5-3600b4bb50db.filesusr.com/ugd/3b0c81_8d5a2429aaea4079a5cdf9f9ca27c58f.pdf?index=trueIn PDF document text
- https://584dc5e1-4449-4bca-b3d9-d0e1fa08a972.filesusr.com/ugd/185caa_52a573994dc348968aa7ed7c7857fb62.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kovezux/dell_latitude_e6410_i3_price_in_india.pdfIn PDF document text
- https://s3.amazonaws.com/pevarijidasalop/taxilivalenezufowilug.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00016e09.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16E09	4876 bytes
SHA-256: `bd9845ab28ead4261be8e673e9449fc31d66102ce53c6e620ef8d7588dbc9734`
`font_01_sfnt_off00017eac.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17EAC	13132 bytes
SHA-256: `73942e237d036961b8ae8cde75e644680d67aa4910cb1fbb5171122f7d536d04`
`font_02_sfnt_off0001a9b8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1A9B8	16164 bytes
SHA-256: `4b52fd5da643d9c08cc0a86f773b2f024e3274f3f861dfcac100db1ef433cf06`

Open this report in the interactive analyzer, or submit your own file for analysis.