PDF malware analysis — malicious · 89a5cf102551507e

MALICIOUS

PDF

96.8 KB Created: 2021-05-16 09:48:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1954e5c1f4a5233e0ab050728e459159 SHA-1: 7274103c02997a3fd2e872a55bf40c28a73427ac SHA-256: 89a5cf102551507eff5798608d423a6a6c4d72724e690913d0407292610fa39d

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to PDF files, suggesting it's part of a link farm designed to drive traffic to potentially malicious sites. The primary URL, https://nipisod.ru/strik, is likely used for phishing or distributing further malware. No scripts were extracted, but the structure and URL patterns are indicative of a phishing or content-luring attack.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/strik?utm_term=bhagwat+geeta+in+english+pdf+gita+press
- http://dakonoge.iblogger.org/beer_manufacturing_process_flow_chart.pdf
- http://vuvefezod.iblogger.org/t._d._o_full_form.pdf
- https://bewimowijukoja.weebly.com/uploads/1/3/4/5/134584545/840bbc44.pdf
- http://loxuzemifa.iblogger.org/33878711739.pdf
- https://getiwojaxewife.weebly.com/uploads/1/3/4/0/134012456/sukojo-xefugivumaberit-rifekifarogib.pdf
- https://nelubetif.weebly.com/uploads/1/3/5/3/135322580/difidukawogerus_wedisupulo.pdf
- https://gozanesudobewer.weebly.com/uploads/1/3/4/8/134852120/peduw-jupipuzebavuv-roxalujut.pdf
- http://qlemelest.online/ler_nana_manga_on-line_espanholtx8j0.pdf
- http://thefortykuti.com/652839482574fe9m.pdf
- http://fedorahosted.org/lohit
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://tovimowu.epizy.com/nuwasininipaz.pdf
- https://3c31dc6e-14a3-4e60-a373-897e90814001.filesusr.com/ugd/9e17d8_bcb5e4697e4e45b0b1bb7e80b4cebc04.pdf?index=true
- http://tuvugerij.rf.gd/22581773244.pdf
- https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_ba7b4125ac334e4b9256c62e31db1243.pdf?index=true
- http://sujobalon.epizy.com/nanekufiwu.pdf
- https://3eeb541e-75be-486c-a732-b1e279b2a932.filesusr.com/ugd/eaab1c_8f526cf2721040669ab1cf02594c58fc.pdf?index=true
- http://kevulapoxokimif.rf.gd/bidomonisowawowumulesen.pdf
- http://borarujedumamut.epizy.com/jisunesetesumetara.pdf
- https://uploads.strikinglycdn.com/files/d9373dd0-e24a-4e8f-ae8d-32be1713da20/bosadaline.pdf
- https://uploads.strikinglycdn.com/files/82322fe4-21fd-411e-aaa6-4ac3048b5d8c/sosajiwavenegopujir.pdf
- https://uploads.strikinglycdn.com/files/dc3d95d4-e10d-488c-b8b8-7b11b4456e29/what_are_some_really_cool_girl_names.pdf
- https://uploads.strikinglycdn.com/files/560533ce-4db0-4042-9bf0-cb60ed1124e4/ssr_125_motor_mount_bushings.pdf
- http://lubudag.epizy.com/organisation_structure_template_word.pdf
- https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_eb96b064235d457c9f92c0fad2343d2c.pdf?index=true
- https://uploads.strikinglycdn.com/files/0c962046-0d36-4b57-8c3b-a568150aedd5/psychological_assessment_exam_questions.pdf
- https://2a009ac4-5770-49f2-ae16-4ce107243443.filesusr.com/ugd/59deca_9e87b3a4ffaa4356b395140c0f9b6d69.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://www.geocities.com/mitra_anirban/hobbies.htmGNU
- http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_006_off000148b8.bin` `9842e48a4c8222be22a8216e4dfd7f80501052bfd1bd407527baca4c5871b9e0`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x148B8	13676 bytes
`font_00_sfnt_off0000fb6b.bin` `89c491222a7463b165bc9e619eaa4eee3ef1dc0dbca150d4a13f8e7d656f748f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFB6B	5444 bytes
`font_01_sfnt_off00010e00.bin` `d0c9e33916e9e64e42e31bcf0d345f6c2fcd41735b1a34df0119bd0eb1094281`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10E00	3720 bytes
`font_02_sfnt_off0001195c.bin` `94e1c8f3250eb4714b7d6c95453b6c4a5269e995b7b9ae75c0e6bf545066ef18`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1195C	2072 bytes
`font_03_sfnt_off000122d0.bin` `f7ce6c6500605388438554941c8755c8da1af8c762817f467a1e893eb4a6ba04`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x122D0	10984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.