PDF malware analysis — malicious · cb5e9a0f2ee3fb05

MALICIOUS

PDF

79.7 KB Created: 2021-04-09 16:42:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 326f2eb6c351d567f6de59b5921f322c SHA-1: ad09abdfcdc9c67a4f4bcfb9447973c44528a87d SHA-256: cb5e9a0f2ee3fb058697d1fdbaec71b50d7c357bb2cf62fea1f34f41246455fe

166 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains numerous external URLs, many hosted on disposable domains, suggesting a link farm or phishing operation. Notably, a heuristic identified a 'Clipboard command execution lure,' indicating the document instructs users to copy and paste content into a shell, likely to execute a second-stage payload via PowerShell or cmd.exe.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dafemum.ru/strik?utm_term=data+analytics+certification+courses+near+me PDF link annotation
- https://tidepobowajaxuk.weebly.com/uploads/1/3/0/8/130814761/gulesajujimevef.pdfIn PDF document text
- http://gordei2d.com/attendance_management_solution_p100j0xqq.pdfIn PDF document text
- https://gevamimukeruku.weebly.com/uploads/1/3/4/6/134656740/50b6439.pdfIn PDF document text
- https://vekefusuxi.weebly.com/uploads/1/3/4/7/134714580/patidamutifunoz_nifunab_duribi.pdfIn PDF document text
- http://fuvagezilavez.mygamesonline.org/vmware_certification_guide.pdfIn PDF document text
- https://dulupuwo.weebly.com/uploads/1/3/5/3/135393712/3413101.pdfIn PDF document text
- http://metryck.info/110199547745vyyi.pdfIn PDF document text
- http://good-production9.site/sofurelitiditezixe1sb0g.pdfIn PDF document text
- http://gepopusoka.mypressonline.com/gst_tax_information_in_marathi.pdfIn PDF document text
- http://huaweistoreukr.xyz/22904362309l80eb.pdfIn PDF document text
- http://skidki-day.store/boards_and_beyond_code_2020fcr56.pdfIn PDF document text
- http://helpcreditscore.info/369416856760geya.pdfIn PDF document text
- http://mepoxov.22web.org/45896084566.pdfIn PDF document text
- https://zofitete.weebly.com/uploads/1/3/2/7/132740948/dobej.pdfIn PDF document text
- http://universityru.fun/constellations_nick_paynewz376.pdfIn PDF document text
- http://nezowigivomi.scienceontheweb.net/87670520805.pdfIn PDF document text
- https://cdn.sqhk.co/wemulekojex/hijbgif/kekasodunoputuw.pdfIn PDF document text
- http://novofikupeneda.mywebcommunity.org/castration_procedure_in_dogs.pdfIn PDF document text
- http://power-guard.shop/rikofiretibzx9aa.pdfIn PDF document text
- https://cdn.sqhk.co/niwonosorude/gfNP4ky/hylonomus_robot_car_game_robot_transforming_games.pdfIn PDF document text
- http://clubstore.pro/boy_scout_requirements_bookb53zl.pdfIn PDF document text
- http://eslivdrug.space/91138377694xrzyt.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://xafafogaditeki.rf.gd/surah_al_rahman_with_urdu_translation.pdfIn PDF document text
- http://xijewixevav.onlinewebshop.net/rebimasejijozalojotu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ec12.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEC12	5008 bytes
SHA-256: `809df052716a6c81d55cc3352514131c5a8d6845f3f59cd365ede7a86bfdf01a`
`font_01_sfnt_off0000fd07.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD07	11084 bytes
SHA-256: `9d2806df67f269b04657d3321afefa7f09255d09ff8179451e9ff301033b6bbe`
`font_02_sfnt_off000122d8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x122D8	4324 bytes
SHA-256: `7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71`

Open this report in the interactive analyzer, or submit your own file for analysis.