PDF malware analysis — malicious · ba616f8c764c4842

MALICIOUS

PDF

106.3 KB Created: 2021-03-22 15:00:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d04c108d42099f34116c586030c43f87 SHA-1: 29c46f9bab0df83aa8738a5831c44434b7cb8ada SHA-256: ba616f8c764c48420876ebf16d3dfd0e3a60ea0060729b11d5d20bd51cdd76de

204 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, with one prominent URL pointing to a page that appears to be a lure for "sbcglobal.net imap settings outlook 2016". The presence of a "password-protected archive handoff" heuristic and a high ML score suggests the document is designed to trick users into downloading a password-protected malicious payload. The ClamAV detection further confirms its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9988

Heuristics 7

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/wix?keyword=sbcglobal.net+imap+settings+outlook+2016
- http://galufixagomedo.getenjoyment.net/cutting_edge_third_edition_pre_intermediate_teacher_s_book.pdf
- https://jenafowumavadas.weebly.com/uploads/1/3/1/4/131437472/gisufuwisuwokom-zujosusi-zeriz-xanojepebifal.pdf
- http://lofajemami.sportsontheweb.net/vutumapisaferibarureda.pdf
- http://futajef.medianewsonline.com/witepumakabe.pdf
- https://nofokupefuw.weebly.com/uploads/1/3/4/6/134695722/lumolejotesuvised.pdf
- http://gakivako.iblogger.org/can_you_share_videos_from_twitter_to_facebook.pdf
- http://zatoxuvisovapuf.sportsontheweb.net/phonetic_chart_explained.pdf
- http://zukoretevir.medianewsonline.com/vazixepegarokewivetoz.pdf
- http://kiladuwujufuzav.22web.org/31547598325.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/8dcd6b5e-4c54-4e31-85ce-0b1cfbb015b3/63231094833.pdf
- https://uploads.strikinglycdn.com/files/ecedc0b1-d667-41a9-8771-af2ac1a210d8/31635036288.pdf
- https://uploads.strikinglycdn.com/files/8c4ed23c-8781-4517-8a8a-a1fc161d48f6/wil_yeung_vegan_ramen_cookbook.pdf
- http://gavisijimaraw.rf.gd/cushing_syndrome_treatment.pdf
- https://d926c97b-7f3b-4ec8-a52a-318bcb589338.filesusr.com/ugd/120f26_eda70290b4d040b7971ba60ae962184d.pdf?index=true
- https://uploads.strikinglycdn.com/files/4aedd632-897f-4e08-834c-2b9691d2595e/neil_dudgeon_character_in_midsomer_murders.pdf
- https://uploads.strikinglycdn.com/files/cf953de1-d54c-474e-80f4-9431f61a9326/34900904384.pdf
- https://uploads.strikinglycdn.com/files/eb6c9550-c262-4f3c-9f0f-c2dd9f9f745c/materials_for_civil_and_construction_engineers_ebook.pdf
- https://uploads.strikinglycdn.com/files/6d5d5921-5e4c-4b59-b1b9-af2d34b96810/mefobesobukinaxowi.pdf
- https://uploads.strikinglycdn.com/files/6c4688e7-c96e-4437-ad61-ca3adf7a435f/easa_electrical_engineering_pocket_handbook.pdf
- https://d12d056d-c16f-42d2-bb36-b12dbd13f8e5.filesusr.com/ugd/a2005d_7e9d244905024853a6a5bae90174267e.pdf?index=true
- https://24a70dd4-b549-4b9e-9c0a-6eea45ab85ad.filesusr.com/ugd/ab0c63_524dcc3cd90d47a6a76050d99d3f289e.pdf?index=true
- https://b00f38ea-0d13-4519-ab0f-1253f0d03ca0.filesusr.com/ugd/289c5e_ebac3e9c1d1343d9a10d73da1c910961.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00013f89.bin` `c9ce4f84746f74d4868d79bff89929884b5fc5292b110feea90d35418096bd84`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13F89	5976 bytes
`font_01_sfnt_off000153d3.bin` `13e295522feba8d3bf24d1cecde5e2024019dd71a459ef12649ce3c135d2a1bd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x153D3	2112 bytes
`font_02_sfnt_off00015da3.bin` `433e646709bfd05f7ff2f6f782f317cd78fff4206d85884086364f8ab11245c8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15DA3	11576 bytes
`font_03_sfnt_off00018594.bin` `b7d3fe0f0eed6e60c79e5026c6c3c7babf05c9d359090ed5b12ebb11be5d450a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x18594	16120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.