PDF malware analysis — malicious · dfb75fef7946a289

MALICIOUS

PDF

82.6 KB Created: 2021-06-09 20:38:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: f0e0afadc23f9d8f6cb80c17cf092c7e SHA-1: 6623ebb9c24716161e1a58faffe9b04bcca4eb0d SHA-256: dfb75fef7946a28950571217f267f6d1b85b7d6aad3f846b5db7d2cf7e5c5b34

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains a large number of external links, many of which are likely part of a link farm designed to improve SEO for malicious content. The primary lure appears to be a fake download link for 'Pokemon fire red version download' pointing to 'https://garglob.ru/pbw'. No scripts were extracted, but the PDF structure and numerous external links suggest it's designed to redirect users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://garglob.ru/pbw?utm_term=pokemon+fire+red+version+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4468572/normal_603740c0c33d0.pdfIn PDF document text
- https://xopezafetuwov.weebly.com/uploads/1/3/5/3/135314897/vadotazuno-kawawen.pdfIn PDF document text
- https://banavodix.weebly.com/uploads/1/3/4/6/134687022/2180208.pdfIn PDF document text
- https://dofabogadu.weebly.com/uploads/1/3/0/7/130739956/redum-vanofos-filuzaru-baxezeget.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405413/normal_5fd60b9c914da.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454691/normal_5fda8bb6e16ab.pdfIn PDF document text
- https://kovegebefubiz.weebly.com/uploads/1/3/4/6/134665714/zivexevekudorodug.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446036/normal_606aea89584a2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411511/normal_60219aa97b44f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/78e7e916-7af3-429d-a63f-2b81b7665db1/rainbow_e_series_vacuum_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dea8b395-259f-46bf-9ece-a5966aca7b69/fisher_and_paykel_fridge_repair_near_me.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2c9e39dc-0be5-423b-b957-136586133bdd/geviwisuwibakomo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a0bada78-24fd-4f3d-9893-79082b2c08be/firasazuxibiferu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b8ff6c25-9077-464b-b7ce-f26e2c0783e6/jufuzitelo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ead8e48c-3b98-420b-8e1c-8c7fa6a09e9c/how_to_adjust_time_on_g_shock_watch_ga_100.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/90a532c5-51b2-4d1f-ab09-afaccc2d9e6e/68993187871.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e9c92aaf-2aa2-4d1f-b41b-6ffd9aafb6d5/analogy_worksheets_with_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f41b869a-2160-4cdb-b238-42e36c1c23fb/fojav.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/71808125-50ea-4eb5-b864-354e302d4f07/84286046712.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b067191-a2a2-4557-a9e8-aade9f29cd65/40589950899.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7efb669f-9d87-4edf-aeac-56a246188594/rival_8455_ice_cream_maker_parts.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d20f33fa-3c44-461d-af73-d828d5140db4/lopewodekuwudazetelez.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f805a7c4-b577-42a9-a41c-be865e3c24f5/what_is_a_classical_literature.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b7397155-c1dc-4636-8389-72dffd4e0269/xizaxisizezovurebevediji.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/938a71e5-1b4c-45af-bf97-451c7bbc4080/constitucion_de_venezuela_vigente_2018.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f7a7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF7A7	4976 bytes
SHA-256: `ae4f62769ed4ff37dbfdfe6be192cca76afb3a89171b70b7c6e0f5078125bcc7`
`font_01_sfnt_off0001087f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1087F	10920 bytes
SHA-256: `def0016da3781100bc57cfab17ada2fa4ad9c7758ca043c69a54ae56fec6b02d`
`font_02_sfnt_off00012d27.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12D27	4324 bytes
SHA-256: `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`

Open this report in the interactive analyzer, or submit your own file for analysis.