PDF malware analysis — malicious · ae3a8dcf72139bf2

MALICIOUS

PDF

77.3 KB Created: 2021-03-05 09:43:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26

MD5: e7f7279fe9b60c94bff084351b0b4491 SHA-1: b4c64f5969371d1183fc50868d3a9f8bfb47c46a SHA-256: ae3a8dcf72139bf2c1f3f2133827a8714e08381b946b53695521a044c8935b45

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to potentially malicious domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also strongly suggest malicious intent. While no scripts were directly extracted, the PDF structure and embedded links are indicative of a phishing or malware distribution scheme, likely initiated via spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/wix?keyword=triumph+4850+cutter+manual PDF link annotation
- https://waxukazo.weebly.com/uploads/1/3/1/0/131071095/nezubupafatiboz.pdfIn PDF document text
- https://liwavijej.weebly.com/uploads/1/3/4/3/134379327/8371268.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://729282ec-1290-4cbc-9302-cf8a24acd4c7.filesusr.com/ugd/42c189_2e9398cd8bb5408cb0651e84c251b90a.pdf?index=trueIn PDF document text
- https://8c1dc56a-a131-4b43-acff-3635b9115217.filesusr.com/ugd/90423f_438f8135316f4ae0a0b1213546049bc3.pdf?index=trueIn PDF document text
- https://03ca3561-abfe-48ca-9b59-b1b2b77f8126.filesusr.com/ugd/1af49e_26e5dceb52554eb9bc93879a0dede525.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/diwitapezu/budafosuginezo.pdfIn PDF document text
- https://ff0b3df2-dc61-4aeb-9024-93fa9b5bc175.filesusr.com/ugd/aa14a9_7ecbd26f58fa41b98ee19bcc29b21b4f.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/veraxawewib/how_to_clean_safety_1st_ultrasonic_360_cool_mist_humidifier_blue.pdfIn PDF document text
- https://s3.amazonaws.com/vexeliku/roxegozovakemilomipu.pdfIn PDF document text
- https://b98ed926-45ef-40ce-ae71-ed36b797890f.filesusr.com/ugd/69695d_58b687ff5239431080f258abb568e446.pdf?index=trueIn PDF document text
- https://faa04d63-7037-46b4-b8cc-e2c8607dce8e.filesusr.com/ugd/a298ce_f084244335f745c1865ad05243d0cac3.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/muvojugejoxip/how_to_fix_canon_printer_that_prints_blank_pages.pdfIn PDF document text
- https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_88a6b720daad4bdca9ce6775c0601dbc.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fizup/halal_food_guide_app.pdfIn PDF document text
- https://s3.amazonaws.com/kujesulad/ruziletisemunujikikux.pdfIn PDF document text
- https://s3.amazonaws.com/naxozelozude/calcium_hydroxide_with_iodoform_use.pdfIn PDF document text
- https://204833c8-abda-4421-8777-5048ee7dd919.filesusr.com/ugd/e30b7a_be5ecc3ab07d426680857fedee2751f1.pdf?index=trueIn PDF document text
- https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_02915a2ef3a7428aa194b00a6cd46ecb.pdf?index=trueIn PDF document text
- https://ee60c613-3dd1-430d-b711-08e3dcbf0273.filesusr.com/ugd/19ce5d_dc9f50cb1fb94907b98ab745fbb53ce2.pdf?index=trueIn PDF document text
- https://61069a5e-3c5f-4884-a3c7-8c7552058b74.filesusr.com/ugd/0789d5_8da4bd51de8d407cb3c5b076133aac40.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/gajakelegeza/adblockplus._org_android_proxy_settings.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e3e9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE3E9	5264 bytes
SHA-256: `2da17213ec92c627a5f1a71c32449196ff05c6e2a8a512ba5365d5ab387c33bb`
`font_01_sfnt_off0000f5a2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5A2	10420 bytes
SHA-256: `a7ab1de7698aa67bc1e125312d1a73f67ea42ffe4ca2062f3b3182fa8560af59`
`font_02_sfnt_off0001195f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1195F	4324 bytes
SHA-256: `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`

Open this report in the interactive analyzer, or submit your own file for analysis.