PDF malware analysis — malicious · d457f4da74234dfa

MALICIOUS

PDF

78.4 KB Created: 2021-04-08 18:24:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: efc382b902e74d8e836dab4579f50a76 SHA-1: 5da6050c2ef9cb026ae27060ea9a525bd0715449 SHA-256: d457f4da74234dfaf5f6edcc0ab2d2e45db7936eac56f57d7159544370e72599

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, many of which are categorized as unknown or potentially malicious, suggesting a link farm or phishing attempt. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to create a large number of external links. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to redirect users to phishing or malware-hosting sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dugedepap.ru/strik?utm_term=how+to+charge+cyclops+reddit PDF link annotation
- http://carinsusa.info/spectrum_math_workbook_grade_8_free92cvz.pdfIn PDF document text
- http://gratoraama.website/a_travs_del_tiempo_brian_weisse5ajf.pdfIn PDF document text
- http://missunik.space/wizogefonibof5plwc.pdfIn PDF document text
- http://folugomobok.getenjoyment.net/82469138553.pdfIn PDF document text
- http://axecheat7.xyz/rovalo4ufoj.pdfIn PDF document text
- http://wowitaly.pro/how_to_write_a_scholarship_essay_about_yourselfcvrcx.pdfIn PDF document text
- http://xumupizaxuto.scienceontheweb.net/fiwonatubomamemiramo.pdfIn PDF document text
- http://nunesop.scienceontheweb.net/novapuforefowudok.pdfIn PDF document text
- http://xsafak.com/project_management_case_studies_kerznergvui4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.opentle.orgIn PDF document text
- https://s3.amazonaws.com/wibedubosateg/filmywap_2019_bollywood_hd_movies.pdfIn PDF document text
- https://5fb42ee6-a9be-400a-98f2-f9d4b9f720c8.filesusr.com/ugd/1813b3_016faf6f66df4a3bbdb77b49cd7204df.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/gawabog/acl_full_form_knee.pdfIn PDF document text
- https://s3.amazonaws.com/towutoginadivu/zenejunoralo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f4233077-04bc-4ade-a6bf-99e0f06227d7/fujitsu_scansnap_s1300i_power_supply.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a6f303b2-8898-4690-8395-35cf1d45e3a7/dell_7010_sff_i5-3470.pdfIn PDF document text
- https://s3.amazonaws.com/lazesej/bifesta_cleansing_sheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/685dc330-e637-4ab4-855d-5b1af7f418b1/excel_vba_function_array_range.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd60d3e1-35ce-4039-859d-e0683ab7a4b6/43496064685.pdfIn PDF document text
- https://d4e9107b-ea7a-46dd-9434-10729a3140ee.filesusr.com/ugd/2e3df4_c33c68687af04e62b5ab6916b590f1ca.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/922c4377-c90b-4b25-9513-b734f2ff36dc/96722203556.pdfIn PDF document text
- https://s3.amazonaws.com/fibesezati/z-table_statistics_positive_and_negative.pdfIn PDF document text
- http://dirulibas.onlinewebshop.net/37368038041.pdfIn PDF document text
- https://0793e221-2e7e-4176-aae8-4ff4b75d8f7a.filesusr.com/ugd/64bd79_ac5ad8e771254934b75e53d30b21c0d3.pdf?index=trueIn PDF document text
- http://xekapakifujekem.onlinewebshop.net/classroom_objects_coloring_pages.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e170.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE170	5488 bytes
SHA-256: `e9ffe6fa0c5a0245330edb781ac021329589599aaadae993e8ccfbd30dfdf7ed`
`font_01_sfnt_off0000f420.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF420	6600 bytes
SHA-256: `b5d091b1028e745a3d0b8ed099c2a0675e92fb6ea957767644eaa2a2a1bd1591`
`font_02_sfnt_off000105ba.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x105BA	11248 bytes
SHA-256: `17fa5d2ba10d8e06e6857700278907fb63862c24c2df27e7d359361a81bf1d43`

Open this report in the interactive analyzer, or submit your own file for analysis.