PDF malware analysis — malicious · cea323fc7e666f5d

MALICIOUS

PDF

73.8 KB Created: 2021-03-18 21:49:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: ed9474e290d61654efdba3e0eb1ff78f SHA-1: cb6b41cfc110591d1606e6c44bad37b9250a2e67 SHA-256: cea323fc7e666f5de5a7c800159fe63ef83bf9f912b4746097c162178e4f9752

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains numerous external links, with a prominent one leading to 'mezovuduw.ru', identified as a potential phishing or malware distribution site. The 'PDF_SEO_LINK_FARM' and 'PDF_SEO_UTM_REDIRECTOR_LINK' heuristics indicate a deliberate attempt to create a link farm for SEO purposes, disguised as a free download lure. ClamAV detection and ML classification further support its malicious nature, likely serving as a dropper or redirector.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/123?utm_term=akashi+seijuro+wallpaper PDF link annotation
- http://jekefidaz.mygamesonline.org/how_to_calculate_current_transformer_va.pdfIn PDF document text
- http://wuroguredogir.getenjoyment.net/varicela_diagnostico_y_tratamiento.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://44eeb0f0-4dc9-4d8b-b3fd-cc7ace98e90e.filesusr.com/ugd/a083a1_cb03cacb132b459885702cbbb0bd6daa.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a28c8b1c-481d-422b-a9c0-cb48e86b3eba/what_is_the_best_beginner_strength_program.pdfIn PDF document text
- https://s3.amazonaws.com/moduxanakuri/nabuzavipuregefizafafob.pdfIn PDF document text
- https://592908bf-dd96-48cc-88d9-ffebbdd10d84.filesusr.com/ugd/f34823_863d64d1e8c24cd3bcf8add1d28d05ff.pdf?index=trueIn PDF document text
- https://882e4f53-a7e1-4d4a-89e8-a6e6d9f9b805.filesusr.com/ugd/9a13d2_8243b2ace0ba4c9a952064896c55f5c2.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/buponuwebi/aa_chak_challa_punjabi_song_video.pdfIn PDF document text
- https://s3.amazonaws.com/zumezeviwakiz/96294617819.pdfIn PDF document text
- https://51956041-da35-40aa-96c1-085c1f47c80d.filesusr.com/ugd/e6e573_3784e46e2f884404a1ea95b459a584d3.pdf?index=trueIn PDF document text
- https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_f27d182a2921419590c0d49b46c96c3c.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/likadojivivofu/77386726357.pdfIn PDF document text
- https://s3.amazonaws.com/tazopaju/fudefevadiluvujakojoto.pdfIn PDF document text
- https://645c32c3-7e99-4959-b93b-7980205539d7.filesusr.com/ugd/30a31c_28eef639bcb04aa4956eae7d4b399a1a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/43f993b6-97c8-4956-bd48-b6c28253ab34/sejizanaturofadewin.pdfIn PDF document text
- https://s3.amazonaws.com/pevuwarobuvowa/anaconda_2_video_song.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cde2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCDE2	5128 bytes
SHA-256: `39b4dddf47261ce04d196dc21cabf27b65fd6f153b969a795c7d80e9723b494a`
`font_01_sfnt_off0000df62.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDF62	10688 bytes
SHA-256: `b2a8c5204c000776f6caeccc225731e03fd65b32122b4f783cbe7c8c0960cc34`
`font_02_sfnt_off000103b8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x103B8	16376 bytes
SHA-256: `edf0adcadd135efd075490cd1abdb66539ef7f90508a0575541fff2dd22ff865`

Open this report in the interactive analyzer, or submit your own file for analysis.