PDF malware analysis — malicious · ccc140d603c0afc4

MALICIOUS

PDF

82.1 KB Created: 2021-03-23 10:12:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02

MD5: 1f6ad462b4ff33fe863440c136225e33 SHA-1: ed79984140f4f435770d3fc5b64fa3c9a0397334 SHA-256: ccc140d603c0afc45fa9b8f87fb879df2df395253f7560f56f1ab478d20b8a0f

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying a link farm designed to direct users to various PDF documents. One prominent external URI, 'https://xezojetit.ru/strik?utm_term=the+vampire+diaries+video+game', suggests a phishing or scam attempt by impersonating a video game lure. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xezojetit.ru/strik?utm_term=the+vampire+diaries+video+game PDF link annotation
- http://mukedasimewiri.22web.org/pobodopokudunigululo.pdfIn PDF document text
- https://rukewopesix.weebly.com/uploads/1/3/4/2/134266340/rajojutasakiz-piritotikajazo-farimawano.pdfIn PDF document text
- http://jodopafipunew.22web.org/all_eyez_on_me_movie_3gp.pdfIn PDF document text
- https://lasogevedona.weebly.com/uploads/1/3/1/3/131398076/6ad5c5bc.pdfIn PDF document text
- https://jefamiwufilidiv.weebly.com/uploads/1/3/1/4/131409158/82543ed3f018d2.pdfIn PDF document text
- https://lozusometuzasop.weebly.com/uploads/1/3/4/7/134741376/aa983da1.pdfIn PDF document text
- http://taxavifosobedul.iblogger.org/nokumosupujawudivefonewex.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/saziwijaxodav/7297836713.pdfIn PDF document text
- https://b89c0965-50b5-483f-b67e-52f573158f4f.filesusr.com/ugd/1e222e_ebe1387fae8e45d991e65bc1b2609ce1.pdf?index=trueIn PDF document text
- https://354df738-7a8c-4643-bdcd-aa58f7c4bd0c.filesusr.com/ugd/69cf62_49b70b1f1136443da1ffc65e2bd5456e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fuwuzerijofa/33390083797.pdfIn PDF document text
- http://puravusixatix.epizy.com/wemubebil.pdfIn PDF document text
- http://nudifezidezi.rf.gd/english_grammar_placement_test.pdfIn PDF document text
- https://34ec465e-51aa-4dba-9a8c-c05fcfb5ae84.filesusr.com/ugd/df15ee_1c3fa21d4fc5466995f8b6b024acd269.pdf?index=trueIn PDF document text
- https://b615eccc-4413-4b1d-8109-ede925130a83.filesusr.com/ugd/0994f9_1d005d9007b4410399dac172fc683773.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lorugipopuxe/92095186794.pdfIn PDF document text
- https://s3.amazonaws.com/kofabube/rijigomimitenewudim.pdfIn PDF document text
- https://s3.amazonaws.com/dumupa/schwinn_womens_ranger_26_mountain_bike_walmart.pdfIn PDF document text
- https://37bdae34-bb2f-403f-997c-54a7c09d9c06.filesusr.com/ugd/dc98cc_861f4e89fb9b401d811ee12d83d044f4.pdf?index=trueIn PDF document text
- https://2ffa788b-df2f-461f-b9c5-573bec542745.filesusr.com/ugd/374ce0_9ce93cda98a24e2c9f01325d4c22e365.pdf?index=trueIn PDF document text
- https://77047a80-9f17-4504-a563-a097c25ca12e.filesusr.com/ugd/5c8b2f_3ad868a72dce418da39812407c5c8288.pdf?index=trueIn PDF document text
- https://1058d175-53f8-4d86-9201-ae9c1fc74009.filesusr.com/ugd/62a633_dfb1670c7f874f789aac78d286085ffb.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/bededuxotulapil/most_clean_sheets_in_epl_this_season.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f65a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF65A	4952 bytes
SHA-256: `b59b206a97954e52e4df01a9b42856c1d126f861e417a1a299bf1ee9a69fd626`
`font_01_sfnt_off00010731.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10731	11028 bytes
SHA-256: `79bd4c60a569eb0f8801433733209845b26d801de959335f29c98d7bb5695123`
`font_02_sfnt_off00012cc1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12CC1	4324 bytes
SHA-256: `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`

Open this report in the interactive analyzer, or submit your own file for analysis.