PDF malware analysis — malicious · a99b5be1b0a958d9

MALICIOUS

PDF

96.3 KB Created: 2021-05-22 22:47:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23

MD5: 24290db00f09316d19a0448514abb866 SHA-1: 2f765e3937621fcfa8853682e44392a3d5ed1be0 SHA-256: a99b5be1b0a958d94b97004816e422ddb545cd0df57b17219901fcf32d7b122f

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a phishing or traffic-generation scheme. The ML classifier and ClamAV detections strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URIs point towards a malicious document, likely delivered via spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/strik?utm_term=present+continuous+affirmative+negative+interrogative+exercises PDF link annotation
- https://razolonupul.weebly.com/uploads/1/3/4/8/134888498/5e73c0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4419218/normal_5fd96ed78eb54.pdfIn PDF document text
- https://nuniladolu.weebly.com/uploads/1/3/0/7/130775245/wagaxe.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414672/normal_6031114ef371e.pdfIn PDF document text
- https://sivevaredewiw.weebly.com/uploads/1/3/4/4/134464028/sikuwivo.pdfIn PDF document text
- https://kujunegisim.weebly.com/uploads/1/3/1/3/131380440/596aa26.pdfIn PDF document text
- https://vuvararuwojagis.weebly.com/uploads/1/3/4/6/134608035/giranotosemuzemiguzi.pdfIn PDF document text
- https://fekamudubop.weebly.com/uploads/1/3/5/3/135325245/0e6b6bc3134b4.pdfIn PDF document text
- https://dujajiworexu.weebly.com/uploads/1/3/4/8/134848881/fomosifubadojap.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4410004/normal_6043fae78a551.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454290/normal_6046e314d8036.pdfIn PDF document text
- https://loxufoxoxow.weebly.com/uploads/1/3/5/9/135982175/6e9c7b1f3685.pdfIn PDF document text
- https://ranagujiw.weebly.com/uploads/1/3/4/5/134585077/6474175.pdfIn PDF document text
- https://nodefosodetapa.weebly.com/uploads/1/3/5/9/135978328/soxalodopotupidul.pdfIn PDF document text
- https://lukadivosegiga.weebly.com/uploads/1/3/4/6/134679105/8041365.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- https://s3.amazonaws.com/faduxodiwo/46367654977.pdfIn PDF document text
- https://s3.amazonaws.com/savifin/papazudalexosamawemilofu.pdfIn PDF document text
- https://s3.amazonaws.com/norozovijalu/analisis_y_diseo_de_sistemas.pdfIn PDF document text
- https://s3.amazonaws.com/bulujono/3548114125.pdfIn PDF document text
- https://s3.amazonaws.com/luxaduzimase/compare_two_spreadsheets_in_excel.pdfIn PDF document text
- https://s3.amazonaws.com/boxalewijim/hec_hms_tutorial_franais.pdfIn PDF document text
- https://s3.amazonaws.com/juzowilipi/why_did_the_estates_general_meet_in_1789.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001223d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1223D	5296 bytes
SHA-256: `12242b7bf854e995260c5608c0cb2d8171a6590db4dbf3ef2847c76ba1d952f1`
`font_01_sfnt_off0001343b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1343B	6520 bytes
SHA-256: `03b4fff6708e06bd2848df4becfdb07bbd7960a7f57990995bbf0dc7d26a1874`
`font_02_sfnt_off00014766.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14766	12644 bytes
SHA-256: `aace8001dc61a05b97717621d83ac56d611cb9f3c523aed04360496c259ea153`

Open this report in the interactive analyzer, or submit your own file for analysis.