PDF malware analysis — malicious · 858083991def7730

MALICIOUS

PDF

81.5 KB Created: 2021-03-17 06:53:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20

MD5: a3b74d1b9ee25915bbf84abd966fb338 SHA-1: 18516b4bd306b05022381141a370001b3dbd1058 SHA-256: 858083991def7730b1c5f5a339465ee19321cc4822ae9140c2401a1bf1b4cb0b

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and an ML classifier indicating high maliciousness. It contains a large number of external links, suggesting a link farm or phishing attempt. The primary malicious URL identified is https://maypoin.ru/123. The document body is heavily obfuscated and unreadable, but the presence of numerous external links points towards a malicious intent to redirect the user to potentially harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://maypoin.ru/123?utm_term=long+beach+island+state+park+fishing+report PDF link annotation
- https://cdn.sqhk.co/rapovixovuti/gcfQpPQ/8038397995.pdfIn PDF document text
- http://bitcoinlearningcentre.online/best_stock_for_beginners_2020t7m4x.pdfIn PDF document text
- https://cdn.sqhk.co/janurisu/cja5hga/healthy_eating_tips_for_halloween.pdfIn PDF document text
- http://fruits-summer.fun/taylor_weight_tracking_scale_instructionsjpc03.pdfIn PDF document text
- http://mebel-albero.ru/bitebavabixewokudivo546ro.pdfIn PDF document text
- http://weraka.online/wuxajatosulkyvyg.pdfIn PDF document text
- https://cdn.sqhk.co/befozaxulot/g3eibud/super_adventure_island_2_snes_rom.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/xalexojaxipud/yenthavadu_gaani_songs.pdfIn PDF document text
- https://c948e902-2437-43f3-9f1e-7aaad30688a7.filesusr.com/ugd/464a75_9d4e28c6ae314dfa9e49154d913c37a1.pdf?index=trueIn PDF document text
- https://24218389-b518-4ca3-8548-65eaf758daa4.filesusr.com/ugd/c836c3_8e6dc9dc48a744d3b027e77c811e1cb2.pdf?index=trueIn PDF document text
- https://ea74ff18-003d-4094-8454-8d7e15e33abb.filesusr.com/ugd/50de67_6866cffeef954612a3f5db8cbf1dd072.pdf?index=trueIn PDF document text
- https://61249681-e2d1-4375-841a-b3723294d79c.filesusr.com/ugd/3d514e_412be6b79ffd4432b3dfd121302c9f8b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nasitevu/air_crash_investigation_special_report_bad_attitude.pdfIn PDF document text
- https://s3.amazonaws.com/jezekemunidup/10621949326.pdfIn PDF document text
- https://e0a971b2-7104-4718-9e5f-4f17d768618f.filesusr.com/ugd/6d43b6_99c047226f2a40bcb1ca5ec22460d3cb.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jolunenafobuw/cello_sheet_music_sound_of_silence.pdfIn PDF document text
- https://s3.amazonaws.com/rezugekolaba/barclays_cardholder_application_form.pdfIn PDF document text
- https://f27bca7f-571c-471d-9e77-92385e6dfcd0.filesusr.com/ugd/9a0fa1_717383b6c4d64927b572940af3488c54.pdf?index=trueIn PDF document text
- https://18e7ef82-5c75-44fe-ae22-4c356c2c9ce0.filesusr.com/ugd/749e61_97c0171b808340eaa4ba62c8bcf8ecf0.pdf?index=trueIn PDF document text
- https://c01188fd-d8af-4b86-846b-090f7ecd58d8.filesusr.com/ugd/9058e5_b762852d3ceb4c51a023fbefa8fef217.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wapabefizosumi/discrete_joint_probability_distribution.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000efdd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEFDD	5352 bytes
SHA-256: `5a357ccd9f788d5785fa8722a415f136ceb2d62259b75948a14456d56038e40b`
`font_01_sfnt_off000101ff.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x101FF	11288 bytes
SHA-256: `e7bfb0811d8638a61725bb162043af5c5525f9939f2ebdfb02bff18017afb353`
`font_02_sfnt_off0001288e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1288E	4324 bytes
SHA-256: `d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378`

Open this report in the interactive analyzer, or submit your own file for analysis.