PDF malware analysis — malicious · 88760f697119a1a4

MALICIOUS

PDF

87.6 KB Created: 2021-03-07 21:39:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23

MD5: 0493042dcbd38fa15c9ef81bb6659cf5 SHA-1: ef353f56df4b26b5af07fed2b790746b7e1a4c74 SHA-256: 88760f697119a1a49623a1c8df6f7ded7900e0046661fdcbd12d5e3daf9c9b12

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. One of the primary external URIs, 'https://mezovuduw.ru/wix?keyword=bob+is+nothing+unblocked', is flagged as suspicious. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically classifying it as a phishing trojan. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create documents that mimic legitimate content for malicious purposes.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/wix?keyword=bob+is+nothing+unblocked PDF link annotation
- https://cdn-cms.f-static.net/uploads/4414494/normal_6036f861758b3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4444636/normal_5ff8bca117966.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4369665/normal_5fdf391c3f8b6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369305/normal_6025fd20b9768.pdfIn PDF document text
- https://puziwifatewir.weebly.com/uploads/1/3/4/7/134715637/1639252.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415292/normal_603ad4209e6a3.pdfIn PDF document text
- https://jawuvufos.weebly.com/uploads/1/3/4/8/134856807/nisat_fagago.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4377098/normal_600905a6507f3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4391620/normal_5fe1458763942.pdfIn PDF document text
- https://nefipoxitusi.weebly.com/uploads/1/3/0/7/130775115/wukibebilamoku.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/454480c6-36ac-4641-b1cc-09e5146ccce1/sudidawadanivuta.pdfIn PDF document text
- https://s3.amazonaws.com/zuguvoxoki/marulepoxirisi.pdfIn PDF document text
- https://s3.amazonaws.com/liwafo/bad_blood_book.pdfIn PDF document text
- https://s3.amazonaws.com/voxipanovigepiv/reporter_news_death_notices.pdfIn PDF document text
- https://s3.amazonaws.com/mexijegedakol/olympus_om-1_md_price.pdfIn PDF document text
- https://s3.amazonaws.com/muxegeza/best_japan_travel_guide_book_2017.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bede11c3-52a7-4f48-8122-e6f14af7d9f4/lolizowamixobo.pdfIn PDF document text
- https://s3.amazonaws.com/matogapibelifiv/mandated_reporting_nys.pdfIn PDF document text
- https://s3.amazonaws.com/nijosinizo/gelalukobimaviwukam.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b0d4ed8c-abb3-4b4c-9b34-3216cf3e3a91/kitchenaid_professional_600_stand_mixer_6_quart.pdfIn PDF document text
- https://forums.windowscentral.com/showthread.php?t=254793&amp;s=e5f2c21e09ee61d7b32f28a1f9786798In PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- https://forums.windowscentral.com/showthread.php?t=254793&amp;amp;s=e5f2c21e09ee61d7b32f28a1f9786798In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010be6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10BE6	6440 bytes
SHA-256: `2ce5a7286efefc5aae27ce1c31b3347e159d00bd30cf97f509a0b7f7d49caffb`
`font_01_sfnt_off00011bdb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11BDB	5148 bytes
SHA-256: `c68f859df8747c57d2fad50df62c829f22b0ed490d1a061b822051cbf6a074b1`
`font_02_sfnt_off00012d5f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12D5F	10336 bytes
SHA-256: `f87cca8489782d559a2299e46e704418cd96d0b40e42de1d1e4cf01fb65d7e9c`

Open this report in the interactive analyzer, or submit your own file for analysis.