PDF malware analysis — malicious · ccca8d4ed6eea665

MALICIOUS

PDF

77.3 KB Created: 2021-03-06 13:20:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 31d837852233ee75fb5ac651e071fc9b SHA-1: 9260c2616b7e4f9882c2a8c0a3c55642be903765 SHA-256: ccca8d4ed6eea665a4aeba0068409f3e3853723a8fcda87b255e591ce51fabaf

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to disposable hosting, suggesting a link farm or SEO manipulation tactic. ClamAV detected it as Pdf.Phishing.Trojan, and ML classification yielded a high probability of maliciousness. The embedded URLs, such as 'https://resalured.ru/strik?utm_term=how+to+work+a+sunbeam+heated+blanket', are likely part of a phishing or scam campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9991

Heuristics 6

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/strik?utm_term=how+to+work+a+sunbeam+heated+blanket
- http://perotaraze.22web.org/mogevebirekojuz.pdf
- http://zekaxezixil.medianewsonline.com/greenworks_2000_psi_pressure_washer_ratings.pdf
- http://zijozarub.mygamesonline.org/xomanomizawim.pdf
- http://desokore.medianewsonline.com/les_mis_2012_summary.pdf
- http://lamakexo.scienceontheweb.net/international_4300_turbo_actuator.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://ddb1515c-011f-4d6c-9a6c-b305a2039a85.filesusr.com/ugd/477ac5_51d57d2443c144a3b190dd03416df289.pdf?index=true
- https://43081b45-6e48-4b43-b724-9328fda377ae.filesusr.com/ugd/26481d_da4021530c054816a3d4a715034911c5.pdf?index=true
- https://76b44699-1094-4fd8-8d4a-70b7be8159c3.filesusr.com/ugd/c450b2_bf8ed1af49fc4089a5f9c54e5c865569.pdf?index=true
- https://f770b3d7-c897-40e0-9323-5ad0abd91552.filesusr.com/ugd/1fa6dd_42050b77664e4c3eaad80ef069d83320.pdf?index=true
- https://c1cb471f-fc5c-4ef2-b3e1-4d0d0d09d135.filesusr.com/ugd/cc5b41_d7d314ecfe204d30a2a04883ef5aff1f.pdf?index=true
- https://2a4c341d-9af7-4f89-b48a-1b926ad6ced7.filesusr.com/ugd/dd6616_e98f73ee77e84d54abfd8911774670e8.pdf?index=true
- https://8c56b32b-3398-45d6-9c0b-b55146621f16.filesusr.com/ugd/6924eb_d416c910b4514d3a92806f9773652644.pdf?index=true
- https://24218389-b518-4ca3-8548-65eaf758daa4.filesusr.com/ugd/c836c3_c1e4d08b279d431e97e87d90f1682509.pdf?index=true
- http://wibenuke.epizy.com/5450019149.pdf
- http://povuputuk.epizy.com/bawarupisujekut.pdf
- https://6b52f5a6-db44-4d3e-8337-ab33c729cb13.filesusr.com/ugd/f4de5e_5497718854794e089586c89e8fd58ae4.pdf?index=true
- https://d9226533-59f4-4737-ae77-cfa9cdee5378.filesusr.com/ugd/d7c203_416ab1fc7c6d4b5cb5c5683b8df494d6.pdf?index=true
- https://ed7c5604-ec0f-4ae6-9d22-6d534b57d154.filesusr.com/ugd/1d5a3f_83824dac569744b8bcb44374a4d9b13f.pdf?index=true
- https://d71fc03c-aea6-48f7-a990-8afffb22108d.filesusr.com/ugd/3de8a6_b40e6568261c45a28767c1ca508849f4.pdf?index=true
- http://rozopujonabesix.epizy.com/aankh_marey_simmba_song_mr_jatt.pdf
- http://nixomirorubu.myartsonline.com/2000_ford_ranger_xlt_3.0_specs.pdf
- https://2aa89031-56ac-4de1-b828-aabe99840ec8.filesusr.com/ugd/cf14a4_32120082d91c429190b357d6e6659be1.pdf?index=true
- https://c2267750-1f6d-4c2f-944a-eb302c7f07d7.filesusr.com/ugd/93971e_1c68ca37ad824104a8e553ea0855263d.pdf?index=true
- https://d2ea4bfc-f92a-4379-acf2-d9b69981ddb7.filesusr.com/ugd/739437_16d4fd15b7fc437682f58f3c8698bff7.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f090.bin` `a17b5ac6af5c984f9888ee79901dc1735bdceb8a304f60cd080d8bfabafe3ee6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF090	5324 bytes
`font_01_sfnt_off00010287.bin` `c3579c7205fe5082d6e07b4bf825ed040a66d32c566ea518f8c22617fdf3e047`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10287	11044 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.