PDF malware analysis — malicious · b0398591846f3d6f

MALICIOUS

PDF

78.9 KB Created: 2021-03-22 22:00:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 169fa39aec75cab4a7cbe73ae2e2c307 SHA-1: 2284101ec7fbb4b80ec8277d862507db1102691a SHA-256: b0398591846f3d6fc9fc41c7dbeaac81b0491ed752fb456f5d2b0e577e9126a6

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan. It contains numerous embedded URLs, one of which, 'https://golowaki.ru/strik?utm_term=why+are+my+photos+opening+in+paint', is presented in a context that suggests a lure to trick users into clicking it. The document body, though heavily obfuscated, contains metadata indicating it was generated by wkhtmltopdf, a tool often used to create malicious PDFs.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://golowaki.ru/strik?utm_term=why+are+my+photos+opening+in+paint PDF link annotation
- http://parazepurafeza.medianewsonline.com/nagokepez.pdfIn PDF document text
- http://nibajafij.medianewsonline.com/appositive_worksheets_with_answers.pdfIn PDF document text
- http://dedigevobunobe.medianewsonline.com/ditexefesavafuke.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://972af30b-04c2-4618-b911-83ba0b7fef9e.filesusr.com/ugd/84a5c6_36c72c892ea74fa8a23a04892fdda2b9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xoferuzu/milafirakugivese.pdfIn PDF document text
- http://jowawaba.atwebpages.com/how_to_clean_the_pump_filter_on_a_lg_tromm_washer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/796b54a6-8360-4703-99dc-7d0de68dcf0c/58942531178.pdfIn PDF document text
- https://s3.amazonaws.com/jotizifime/bangla_movie_choto_bou.pdfIn PDF document text
- https://s3.amazonaws.com/lizuseguwix/how_late_can_you_be_for_walmart_grocery_pickup.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0ddde40f-b710-48aa-97b7-b3ed52b9e72e/57946815281.pdfIn PDF document text
- https://058da8ce-bb30-4b8c-81eb-8903018cac65.filesusr.com/ugd/ab745b_7f261cc0e59f43589e0b63482e8d4718.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/98ffb9ca-7008-46eb-ac77-699fa44bbaf0/54827553684.pdfIn PDF document text
- https://s3.amazonaws.com/bisiku/addition_sums_worksheet_for_grade_3.pdfIn PDF document text
- http://ziwemasux.myartsonline.com/75620828010.pdfIn PDF document text
- https://61090d85-22e6-4724-b969-52a17785150c.filesusr.com/ugd/952c2e_e23ff2e46a8341238b0dffadc490ab31.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wazagidonux/18219381032.pdfIn PDF document text
- https://ec8c99fd-5413-4e38-b6a0-2ccbba71fc6f.filesusr.com/ugd/de02f3_2c03abfbd42c47379d76d8f4e39ba8f7.pdf?index=trueIn PDF document text
- http://rujidafedisezu.atwebpages.com/jurnal_bovine_ephemeral_fever.pdfIn PDF document text
- https://s3.amazonaws.com/moduxanakuri/lcm_and_gcf_fractions_worksheet.pdfIn PDF document text
- https://a9d1d3ec-13fa-4b7e-abe1-abe2c2ba1301.filesusr.com/ugd/f83029_803257ce0f50440da997631a80c8c4a2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0521af0f-d709-4eab-8240-feace56f2d1d/74308354726.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/83379bdd-57d0-4c12-9ea5-23a461d8b482/26631653233.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f64f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF64F	5316 bytes
SHA-256: `7e6c863af387695b8a2fc51d22f99d30fc97c6410e2f1e623e5d1bfe95b4fce7`
`font_01_sfnt_off00010852.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10852	11120 bytes
SHA-256: `76defaacbd93ddf36928e31f295e3bccf8e309fd5235220ed13abeba6f742934`

Open this report in the interactive analyzer, or submit your own file for analysis.