PDF malware analysis — malicious · b49020fe2920c303

MALICIOUS

PDF

89.8 KB Created: 2021-04-16 20:34:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13

MD5: fefd066bfff12843f24ef7a094ab03fa SHA-1: 050d372d48fa47ca67bfbb6a72b256e172c67614 SHA-256: b49020fe2920c3036f843d8ad294f43c385b680b264c5e173cb991517f3e021a

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with the primary URL pointing to a domain associated with malicious activity. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of generated links, suggesting a tactic to distribute malicious content or phish users. Although no scripts were explicitly extracted, the PDF structure and embedded URLs strongly suggest an attempt to redirect the user to a malicious site, likely for phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9989

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jumiwimov.ru/strik?utm_term=starcraft+2+wiki+terran PDF link annotation
- http://tulusujubige.mygamesonline.org/banishing_bureaucracy.pdfIn PDF document text
- http://recepty-dd.info/how_to_use_a_three_circle_venn_diagramahfqk.pdfIn PDF document text
- http://kakorezikudu.mypressonline.com/antonio_candido.pdfIn PDF document text
- http://formblckr1.xyz/can_a_pregnancy_test_evaporation_line_be_pinkp1vep.pdfIn PDF document text
- https://leruvipox.weebly.com/uploads/1/3/5/3/135347136/78317f24b2464d7.pdfIn PDF document text
- https://kagamufoxigog.weebly.com/uploads/1/3/4/0/134013308/tubedese_rudifin_jesetidiwoliben_tilix.pdfIn PDF document text
- http://airned.ru/refokafomagazigezupinpr7pl.pdfIn PDF document text
- https://rirofogarerena.weebly.com/uploads/1/3/0/7/130775169/6923586.pdfIn PDF document text
- http://latencfsrt.space/what_is_college_algebra_consideredh3qai.pdfIn PDF document text
- https://tulelamesesixe.weebly.com/uploads/1/3/5/3/135321102/b311f48e1f.pdfIn PDF document text
- http://lomigakorak.getenjoyment.net/2591481523.pdfIn PDF document text
- http://qiwi-wallet.online/how_to_make_vr_glasses_for_pcron0v.pdfIn PDF document text
- https://xisuviwilizej.weebly.com/uploads/1/3/4/3/134320176/ff936f42.pdfIn PDF document text
- http://zawopim.mygamesonline.org/nolizexobixu.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/woneketelak/78223029496.pdfIn PDF document text
- https://s3.amazonaws.com/debamijizozexo/lagu_blinding_sunrise_gurenge.pdfIn PDF document text
- https://s3.amazonaws.com/remavuj/gesafanadariwekikajituma.pdfIn PDF document text
- https://s3.amazonaws.com/tupofelasujewas/nawojaxijamagigox.pdfIn PDF document text
- https://s3.amazonaws.com/tawovojo/81448689074.pdfIn PDF document text
- https://s3.amazonaws.com/julexekubaj/mufonufowedegixukexubajob.pdfIn PDF document text
- https://4541bc1c-e35c-4de3-bb44-1f53c3e1a56d.filesusr.com/ugd/68f66e_3cd860c3551b432786a33e704c5bebf8.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lokijuronig/jonezazufaxoxepufogelaka.pdfIn PDF document text
- http://tososite.onlinewebshop.net/tulojesorapekagejepik.pdfIn PDF document text
- https://6f1239e7-da96-47bf-8adb-22d47a96a9da.filesusr.com/ugd/bb5a15_0d6938348ebe4f0894f8fdb626fbd74d.pdf?index=trueIn PDF document text
- https://c064424b-11a8-4e39-a524-24a74bcd733d.filesusr.com/ugd/54e393_bfd25a14d8a84e8da10a899b5e9c03e6.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001068b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1068B	5056 bytes
SHA-256: `8deed9d700e8831045eb511e3b00a2de67d86076d6495b982b257cef1bf5285d`
`font_01_sfnt_off000117e8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x117E8	13340 bytes
SHA-256: `a7566598a00de6751e954094a0f72b9188e3db8620e852d91be7a9d90084e976`
`font_02_sfnt_off00014383.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14383	16416 bytes
SHA-256: `b13feff8c5b564f7677060085945be61112f8f7aeeaada995cbedf689070d2bf`

Open this report in the interactive analyzer, or submit your own file for analysis.