PDF malware analysis — malicious · 89d5afab085a5d8b

MALICIOUS

PDF

78.1 KB Created: 2021-03-27 22:20:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21

MD5: ae88bf55fa5e43c3ccfa43d62c84d625 SHA-1: a293e5978ec7a446b526c24f4628c4ef8dfdc044 SHA-256: 89d5afab085a5d8b82586a693c8f1db1f08fb1ba6fd84b0a73372bfa02cf80f2

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, many of which are part of a link farm designed to appear as search results for an art book. The primary malicious URL identified is https://midufefew.ru/award?keyword=date+a+live+tsunako+art+book+spirit+pdf, which is likely used to redirect users to a phishing site or download further malware. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://midufefew.ru/award?keyword=date+a+live+tsunako+art+book+spirit+pdf PDF link annotation
- https://cdn.sqhk.co/tevosudav/csmJeia/42094716822.pdfIn PDF document text
- http://lojowonuzexifu.iblogger.org/dedication_for_ojt_narrative_report.pdfIn PDF document text
- https://cdn.sqhk.co/remezebona/iijdm6k/obras_de_anaximandro.pdfIn PDF document text
- https://cdn.sqhk.co/wizokawoxo/jjeiaWb/nisumapibetimiro.pdfIn PDF document text
- https://cdn.sqhk.co/pugudanirav/dggwYjd/59660809722.pdfIn PDF document text
- https://cdn.sqhk.co/vinogusi/hchiehi/leapfrog_video_game_system.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://rolewafofe.epizy.com/foxasokomirivowejinavi.pdfIn PDF document text
- https://s3.amazonaws.com/legapatatezisa/anti_ragging_form_for_pg_students.pdfIn PDF document text
- https://s3.amazonaws.com/bezorito/43692534480.pdfIn PDF document text
- https://cda84be5-0c54-4c05-8389-97bb004c798d.filesusr.com/ugd/fa9f00_0327d99447ce434db28713715bb439a2.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/bubeto/bihari_dj_remix_song.pdfIn PDF document text
- https://6d4a8fb0-9a8a-4850-8aa1-2b5706121c9a.filesusr.com/ugd/ff2e72_c137c8a6305f49ac94d43526043b9bc5.pdf?index=trueIn PDF document text
- http://disukifas.epizy.com/dot_net_framework_4._5_1_free.pdfIn PDF document text
- https://5c817321-7c0c-448b-959d-deb1da9fd788.filesusr.com/ugd/19103d_0cfcc78de9a54ba397b2493787a65b35.pdf?index=trueIn PDF document text
- https://d9226533-59f4-4737-ae77-cfa9cdee5378.filesusr.com/ugd/d7c203_582cf7b059374f35b63510c6ef249dd6.pdf?index=trueIn PDF document text
- https://7afd96e6-4611-46d4-9b98-d111b897c281.filesusr.com/ugd/154221_c4220a5f2ee94df194ef7c227aa594b7.pdf?index=trueIn PDF document text
- http://tupusivamiguta.rf.gd/39614312416.pdfIn PDF document text
- https://s3.amazonaws.com/xasovewipeje/26190663839.pdfIn PDF document text
- https://200c4c3d-185b-4246-b99f-f40cd7065c99.filesusr.com/ugd/3ed902_fec5486dee7142e291ae90d43558c180.pdf?index=trueIn PDF document text
- https://631ffb88-cf2d-4844-8d6b-9338a1b21cc5.filesusr.com/ugd/d24e6f_8b343baa23b94fd5b3536e4ca614336c.pdf?index=trueIn PDF document text
- https://234d5d8d-19c9-4cab-a884-dd0775662658.filesusr.com/ugd/fb7225_5407117ec70140ceb8895c84ba0b53b2.pdf?index=trueIn PDF document text
- https://2d2b1dae-c014-4902-97e6-c3f1d56915cd.filesusr.com/ugd/70e5f7_4fe5b46f6d994cf985cbb92d6be06689.pdf?index=trueIn PDF document text
- https://4095172d-bd2f-4181-91d7-dd424e653400.filesusr.com/ugd/df73ab_b64e4c02cf634abbb14bf6d05eeaea57.pdf?index=trueIn PDF document text
- https://96daf755-36ed-4ece-a185-bed8db3f70ea.filesusr.com/ugd/a95cda_5e5b3f4d6e2644b887d02c2a64967c04.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e234.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE234	5084 bytes
SHA-256: `8174a2992aff0ad3c2598b325e911085e2a88ad699924c43591662a7dac61736`
`font_01_sfnt_off0000f3e5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF3E5	5300 bytes
SHA-256: `83fa60a4057053a6880a5da2d01c8859fdf988dedcbad036a76518ff262f6737`
`font_02_sfnt_off00010603.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10603	10668 bytes
SHA-256: `d443c69d0717d646b8b25e78212bc33590a75bb0cdcb63981027678bb13c3792`

Open this report in the interactive analyzer, or submit your own file for analysis.