PDF malware analysis — malicious · b94071b80a6929c7

MALICIOUS

PDF

71.1 KB Created: 2021-03-16 08:15:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02

MD5: ecf35e830428b4c192592053f067270e SHA-1: 9f99506ad4fd4c538efb1149018547807ba1baa4 SHA-256: b94071b80a6929c78a59a41ec524c1bb6872b5e26e995fb1320493e1e0185fb2

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document contains a large number of external links, with 'http://jotitojimo.mygamesonline.org/tudekimabawunilof.pdf' being a prominent example. The presence of embedded URLs, including 'https://resalured.ru/123?utm_term=super+chibi+knight++linux', further supports the attack pattern of directing users to potentially harmful external sites. Although no scripts were explicitly extracted, the PDF structure and link farm heuristic point towards a phishing or malicious redirection scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.9993

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/123?utm_term=super+chibi+knight++linux PDF link annotation
- http://jotitojimo.mygamesonline.org/tudekimabawunilof.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412887/normal_603b1a1955f03.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446270/normal_602835136c5c3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4443357/normal_5fdeb2020af83.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369173/normal_6014859279214.pdfIn PDF document text
- http://boribonabone.mypressonline.com/94410539423.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4470830/normal_6007dfd4c1ddc.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4404103/normal_5fdfc9ef6af70.pdfIn PDF document text
- http://pozijuza.scienceontheweb.net/funcion_de_hormonas_del_sistema_endocrino.pdfIn PDF document text
- http://kigirifaduguv.getenjoyment.net/what_is_the_best_above_ground_swimming_pool_filters.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_45e59f6b33284163aaaf7c03cf9d443b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/rixevozajixezos/chocolatey_exception_calling_string.pdfIn PDF document text
- https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_5eeff3e8cbec4448b761fa74cb9bda10.pdf?index=trueIn PDF document text
- https://40785fcd-1e5e-4316-9306-5db1d5795eae.filesusr.com/ugd/2f07a1_3543fc71a6e84c5daf29bbd232c8f15a.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xilasisefi/plan_de_negocios_template.pdfIn PDF document text
- https://s3.amazonaws.com/xutomoxu/elite_dangerous_upgrade_guide.pdfIn PDF document text
- https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_d57147bedea14a14b3e8b6b73da23eb2.pdf?index=trueIn PDF document text
- https://e1bd05e7-a2ed-43df-b5fc-9bc8ee0b1a84.filesusr.com/ugd/08acf3_4e255e85480d4e28a2228acd117e62f6.pdf?index=trueIn PDF document text
- https://94226b1b-8363-4ad6-a779-e61b7b16ff5b.filesusr.com/ugd/b3bc21_2096eee48579459a863f141bb0c6acb1.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/rijaliwiguvex/rapegukobavodu.pdfIn PDF document text
- https://0b7b936c-93ac-4a60-9644-6ba220b934cc.filesusr.com/ugd/b4bf80_193751d75ad9430a89d7721def999095.pdf?index=trueIn PDF document text
- https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_ad37106127d04b93944dd768c3ff67be.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sosupejuxofedo/rogers_barrie_tv_guide.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d97f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD97F	5180 bytes
SHA-256: `1bdd318aae0a285707d1a9ab0adf03c578007bc9a46ba590e38d6233bad6fd9d`
`font_01_sfnt_off0000eb24.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB24	10924 bytes
SHA-256: `d679b97c741c37e6b31e6cb835d154123bbe8679b1524378c34f2d5a9c51cb4d`

Open this report in the interactive analyzer, or submit your own file for analysis.