PDF malware analysis — malicious · b3623fc05b541886

MALICIOUS

PDF

95.0 KB Created: 2021-05-29 04:53:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: ec9f4f077d42ccf176a5211d35614e1b SHA-1: 67a6afae3e066da811bf04c66e95517d39635e04 SHA-256: b3623fc05b5418860319a6d0f614e84c40c05b2a6ad72cb954a4b7c3f45f1eb5

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or SEO spam campaign. It contains a large number of external links, with the primary suspicious URL being https://baarspo.ru/wb?keyword=don%20juan%20demarco%20soundtrack%20download. No scripts were extracted, but the PDF structure and numerous external links suggest an attempt to redirect users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://baarspo.ru/wb?keyword=don%20juan%20demarco%20soundtrack%20download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4413838/normal_600da72bcfd0b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403820/normal_6013687ac61ea.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408180/normal_60656c9c0a597.pdfIn PDF document text
- https://rujunile.weebly.com/uploads/1/3/2/7/132710621/da2d70023b39f4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384046/normal_6041463aaa990.pdfIn PDF document text
- https://fumunavizagoz.weebly.com/uploads/1/3/4/2/134235019/gajaxulixoxuterumin.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403823/normal_603487cb25a43.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4458137/normal_600cb6fa42fba.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376374/normal_6012171e63095.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4483072/normal_602ae7c29bbd7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4410727/normal_601459a09c139.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462708/normal_5fd5f0d185f42.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4404730/normal_6025022bcad4b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/002c5907-5ede-4f74-aee7-0222cc158fe9/guxokabovutakaf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ea4b6e15-e69b-43d9-8ed6-ee13639b8f3e/64421304728.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e7278edc-48d3-4604-8840-7e6b1200e370/27611334412.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f60b9d13-d829-4cbc-8db3-00d60c455269/denon_avr_x2000_price_in_india.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e6055bf3-fda0-4f8b-a79b-d285caf5ea5e/pizetikegutetugafe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa7a33cb-2f96-4bf2-9f1e-bb5dbe9b32f6/is_gimp_virus_free.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000120a3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x120A3	5152 bytes
SHA-256: `b43bfb21f8eb6c992478f474edbf97791c1c4175df45cd5fd7de09230649555a`
`font_01_sfnt_off0001322c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1322C	13628 bytes
SHA-256: `338aba4878c5187715a6146bf257cac595aed78d80b569c1003311f6d54d9511`
`font_02_sfnt_off00015f1f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15F1F	4324 bytes
SHA-256: `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`

Open this report in the interactive analyzer, or submit your own file for analysis.