PDF malware analysis — malicious · d19d5d7ff9adcc78

MALICIOUS

PDF

92.2 KB Created: 2021-03-20 21:04:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 14d0a6f6b79ab0407b3c5666550d75da SHA-1: 987d77115f6ab09f9940e9b621bba03b6285102f SHA-256: d19d5d7ff9adcc78c0e2c1311cee401be8b153e91bfe9260519c5228db8b1ad2

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, suggesting a link farm or phishing attempt, as indicated by the PDF_SEO_LINK_FARM heuristic. The embedded URL `https://mezovuduw.ru/strik?utm_term=fundamentals+of+logic+design+7th+edition+solutions+pdf+download` further supports this, masquerading as a legitimate download. ClamAV detection as `Pdf.Phishing.Trojan` and the ML classifier output confirm the malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/strik?utm_term=fundamentals+of+logic+design+7th+edition+solutions+pdf+download
- http://sadanojigoma.22web.org/baumanometro_manual_farmacia_guadalajara.pdf
- https://bekajujoxofutit.weebly.com/uploads/1/3/1/4/131406668/sasikoxoxugapakebe.pdf
- http://mafesilotob.iblogger.org/dexefozukivaliketosomo.pdf
- https://kagojidumone.weebly.com/uploads/1/3/2/7/132740327/1051758.pdf
- https://titawijuneve.weebly.com/uploads/1/3/4/0/134012454/naruvazo.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jaloto/vevokuzejikobeb.pdf
- http://winuzuvejifod.epizy.com/naguje.pdf
- http://robexede.rf.gd/concept_of_human_development.pdf
- https://d71fc03c-aea6-48f7-a990-8afffb22108d.filesusr.com/ugd/3de8a6_1af676f7c7f14d1d844508f27821cb5c.pdf?index=true
- https://s3.amazonaws.com/genedesowul/chitta_song_veet_baljit.pdf
- http://bizivedigudo.epizy.com/konica_transfer_belt_reset.pdf
- http://giluzufuropej.epizy.com/how_to_sign_up_for_chick_fil_a_text_messages.pdf
- https://s3.amazonaws.com/tevomenil/34592881423.pdf
- https://s3.amazonaws.com/kokesatodixon/bedewutag.pdf
- http://lenomona.rf.gd/artifex_mundi_android.pdf
- http://fizuvofodiku.epizy.com/40028146436.pdf
- http://ximawefab.epizy.com/31489695935.pdf
- https://c84d532c-3b33-47d6-96aa-4134a1164eb1.filesusr.com/ugd/6d45f6_f5db0889074741bfb64a7ec81b460f40.pdf?index=true
- https://a179b4bb-f9e1-4b0b-8685-f881d2afde68.filesusr.com/ugd/0fdb6d_10d41164cafd4947b1c34e2ec7baef7b.pdf?index=true
- http://tozibuxadotoba.epizy.com/salmon_fishing_lake_michigan_reports.pdf
- https://s3.amazonaws.com/boduxatavepe/custodial_staffing_guidelines_appa.pdf
- https://9d50af6f-dbf7-41ba-b854-83985329a12b.filesusr.com/ugd/33c377_2fbb8388df1945df953cdcc147e8e7d7.pdf?index=true
- https://s3.amazonaws.com/xebuvuwov/bardaasht_movie_dvdrip.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00012622.bin` `87b03119387936fdfea1b5466e39d610c714e68fc4a35c094ec0771a0b24c68a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12622	5600 bytes
`font_01_sfnt_off0001392d.bin` `99acaf33914ea856b7cb7eb11657ca0f82c7d98912f125bbaef47dd64f0dfb9d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1392D	13052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.