PDF malware analysis — malicious · c378058808d8c129

MALICIOUS

PDF

78.5 KB Created: 2021-03-14 02:58:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9725f44953b23220d4efd150c3aae7b5 SHA-1: e92da816431f2774b3a1366b5db886f436dee60e SHA-256: c378058808d8c1298e0c76b192482d7bfe581e0a627feffa7365bb3ab61def04

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier. It contains numerous external links, with a significant portion pointing to a link farm designed for SEO purposes, and one specific URL that appears to be a phishing lure. The PDF's structure and embedded content suggest it is used to drive traffic to malicious or spam websites.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/wix?keyword=metric+system+conversion+chart+for+baking
- https://static.s123-cdn-static.com/uploads/4444852/normal_5ff1bbcd1d056.pdf
- https://cdn-cms.f-static.net/uploads/4445125/normal_603ac543ad3c4.pdf
- https://cdn-cms.f-static.net/uploads/4421461/normal_6026d49086035.pdf
- https://cdn-cms.f-static.net/uploads/4503035/normal_60462a0f65c30.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/45f206e3-4c08-4d76-917a-920021365ffd/tappan_oven_pilot_light.pdf
- https://uploads.strikinglycdn.com/files/d08e6f83-98ce-42d3-8258-127a692e3de9/how_to_connect_usb_to_computer.pdf
- https://8772a198-af03-49ef-8724-5feb7546cb8a.filesusr.com/ugd/436f04_cc542583cca54d4c9f34806aa1320ddd.pdf?index=true
- https://ce83042b-5faf-46b5-bcbb-9b4d05ec7d33.filesusr.com/ugd/a31856_f4b4b500023e4d35a402c7252d4a8a8e.pdf?index=true
- https://d5e9a058-cbdc-4968-ba72-30cdbf1e36a3.filesusr.com/ugd/9cfd0a_9166c51b38ba4aab883a701b8b31cec7.pdf?index=true
- https://f6ce3cfb-f922-470c-9e0e-eaf724001b0e.filesusr.com/ugd/defcb2_d418d1788f3c45df8475763f10c556c4.pdf?index=true
- https://uploads.strikinglycdn.com/files/b3fa156b-5abc-4563-9eac-629f8b9619a5/5872364359.pdf
- https://c31d65df-273c-4bcc-acfb-7b03b0724b99.filesusr.com/ugd/e7e4a0_4691bd0db0964998bbf5ba529c49044c.pdf?index=true
- https://12c48f50-3553-44c7-a31c-19fc5df83d07.filesusr.com/ugd/7e0eb0_b3958db80d474b76b460e1a2e016617b.pdf?index=true
- https://s3.amazonaws.com/jezekemunidup/s_love_k_letter_whatsapp_status.pdf
- https://488c2ff9-9ff4-499e-8f11-525115e20b22.filesusr.com/ugd/8aba0c_4473fdb0595f4ec79d0479d9a95adab4.pdf?index=true
- https://s3.amazonaws.com/desekusoxi/90612559164.pdf
- https://3e1d1bad-f645-4ebd-ac75-469e7ff7c972.filesusr.com/ugd/e745be_b2ac9ac878b54a2d9dff5f0ed2ec357d.pdf?index=true
- https://uploads.strikinglycdn.com/files/198f62b7-321d-49e6-8dd7-b9ca099d82e8/30629752789.pdf
- https://uploads.strikinglycdn.com/files/1236a2fb-5088-4791-81ad-0ce09a72a2b3/5650058129.pdf
- https://510adc33-753b-44c0-977e-8d34da8fcdd4.filesusr.com/ugd/5f4192_7e4ea2acf3f84b0cba68737f393dfa9c.pdf?index=true
- https://850a36a1-966c-46c3-86ed-e15bcb5778a7.filesusr.com/ugd/ede58b_a8dd5debe93d435580cb8b1c289f40e6.pdf?index=true
- https://acfcda0b-1795-4b40-aedc-9a0bc13047ce.filesusr.com/ugd/89c6ad_4e0327258f7e4cab840a1f80ae177c07.pdf?index=true
- https://3745348a-78a0-42d7-8ff4-af2b45bf5faf.filesusr.com/ugd/02631b_217d11656c8d4a86bca8fc2feb0db9bf.pdf?index=true
- https://s3.amazonaws.com/zifilobesumafi/6827766856.pdf
- https://00407fa8-a9ef-4b78-9bbe-46147fc8acf6.filesusr.com/ugd/5ecadc_3ba29c89e065425a94ea8d34c27fcc7c.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f436.bin` `7400eac258464c149ea200e8134622a1a347ba18c2b6f23de9974dda1debff21`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF436	5636 bytes
`font_01_sfnt_off00010756.bin` `c83da35d43f1d09d60b7c36fa0b4ad500f25158f3479ae5966d7ae503fdc62f4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10756	10820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.