PDF malware analysis — malicious · 92a7b27c55d7abd2

MALICIOUS

PDF

91.6 KB Created: 2021-05-18 21:59:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22

MD5: 899e5593bb2988a6a47a2c3330ba61a9 SHA-1: 999d125c0706344eeb17101a70829680210bd628 SHA-256: 92a7b27c55d7abd2eeb19a84aa66eac195ef2f5767e8416c8b2ae7ccf0fdff41

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing lure. The primary URL, https://midufefew.ru/strik?utm_term=plein+ecran+premiere+pro+2017, is presented in a way that suggests it is related to video editing software, likely to trick users into clicking. ClamAV and ML classifiers also identified this PDF as malicious, specifically as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9917

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://midufefew.ru/strik?utm_term=plein+ecran+premiere+pro+2017 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4480736/normal_602a178b882e1.pdfIn PDF document text
- https://damanula.weebly.com/uploads/1/3/1/8/131856109/c7f4b4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470223/normal_6030fa424ee83.pdfIn PDF document text
- https://rewemekekebaz.weebly.com/uploads/1/3/1/4/131406535/wekafotibe_jozawuvu.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4402936/normal_60011c60c6724.pdfIn PDF document text
- https://nuvisinuxaxo.weebly.com/uploads/1/3/1/3/131383681/newiwesawuxa.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4486206/normal_5feb30210243c.pdfIn PDF document text
- https://pevolevu.weebly.com/uploads/1/3/1/6/131606362/miwam_wawejavemol.pdfIn PDF document text
- https://zisatusomet.weebly.com/uploads/1/3/4/8/134872515/4311533.pdfIn PDF document text
- https://jirakeleda.weebly.com/uploads/1/3/5/9/135992973/1253914.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460048/normal_602d5077a4537.pdfIn PDF document text
- https://zugatuwedi.weebly.com/uploads/1/3/0/8/130874050/nugateve.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4407664/normal_6058130f7d991.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374956/normal_601167ca5fcb6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381344/normal_6032f516c247b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418567/normal_6063ec36e30c4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4444353/normal_6036dd3fd5183.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4464523/normal_6059ca5c10ca8.pdfIn PDF document text
- https://memarexegota.weebly.com/uploads/1/3/4/3/134366516/mekezej.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366958/normal_5fd935c7953a6.pdfIn PDF document text
- https://voxugenones.weebly.com/uploads/1/3/1/8/131871951/6497211.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4474723/normal_604b9cff7b916.pdfIn PDF document text
- https://pudasebedizut.weebly.com/uploads/1/3/4/5/134587980/396dc7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/51efdf7d-d682-4977-870f-419cdc1c4f78/what_was_ancient_greek_famous_for.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3a350c8c-f7c7-43ff-8a07-92e0e858d417/lista_de_verbos_regulares_en_ingles_presente_pasado_y_participio_y_traduccion.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f3e4aa46-ac4a-4574-be04-32018fdeb0b5/besirive.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/886bd93b-f601-4042-adcc-56360ba2cf07/isentropic_compression_efficiency_formula.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e3bf8c85-c92f-42ac-8983-0d9ff69e36e3/vuwinajid.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000104c7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x104C7	5308 bytes
SHA-256: `cb93ff40f57bc1bd9cfe99a32c73304f83c203d88beb4218bb553d6c69e46266`
`font_01_sfnt_off000116c5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x116C5	1800 bytes
SHA-256: `daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e`
`font_02_sfnt_off00011f53.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11F53	12916 bytes
SHA-256: `a248db1e728c8c28733e212ac28fa19e459a2a644a7c4e044eec604cc9299e8b`
`font_03_sfnt_off00014858.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14858	16376 bytes
SHA-256: `684a3c196e802b4dc45ee85e0d12f41c83d6b6c6a55a83cec5fb8e332ee9aa36`

Open this report in the interactive analyzer, or submit your own file for analysis.