PDF malware analysis — malicious · e36cfcdc4bd0c7c4

MALICIOUS

PDF

77.8 KB Created: 2021-03-05 23:00:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07

MD5: 8f8241d0fb4449e093a16f2c9c5d054b SHA-1: 5c8b661a3f6a3f864dcad90a890a4fcd2721dfcc SHA-256: e36cfcdc4bd0c7c4bdd33ecb6bde5db4f2e8a341c56a116db7ae1671c9f56b63

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, suggesting it is part of a link farm or phishing campaign. The primary malicious URL identified is https://mezovuduw.ru/wix?keyword=williraye+studio+halloween, which likely serves as a lure or a redirect to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9960

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/wix?keyword=williraye+studio+halloween PDF link annotation
- https://static.s123-cdn-static.com/uploads/4379237/normal_5ffcbea940964.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4416151/normal_6027378b75f64.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408719/normal_6037903192e27.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4375351/normal_5ff5f9241fa59.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451753/normal_60201eea94a1e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468294/normal_6041d965ddc1c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4378608/normal_5feed31390c62.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4420468/normal_6003cdcc24347.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://95fbbc11-640f-4658-acdf-6e09da746871.filesusr.com/ugd/e42ee3_9e21db67167f46108d1fe113f7d5a6cf.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fekaduvopigab/wenezolelivag.pdfIn PDF document text
- https://a39ac558-8fe8-437d-9e10-dc9402d6cb9c.filesusr.com/ugd/1ebe14_3e543d3459344dd8afd374660392b9e4.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wazotojemov/82604775515.pdfIn PDF document text
- https://s3.amazonaws.com/fajeloninesitel/pedir.pdfIn PDF document text
- https://63aa7d51-6c54-48cc-ac87-b710a0da19c3.filesusr.com/ugd/c8d394_60e9a1c6ba0046639e7d0f230fb1c2a9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kujapomib/24745479472.pdfIn PDF document text
- https://s3.amazonaws.com/faduxodiwo/how_to_hard_reset_a_denon_receiver.pdfIn PDF document text
- https://98748e4b-3258-471a-903e-8ea98415cca0.filesusr.com/ugd/fd7405_17ab784b4d014e8bac53424e2094c598.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fokapikow/muzinenivija.pdfIn PDF document text
- https://s3.amazonaws.com/zowibatev/landforms_created_by_glacial_erosion_and_deposition.pdfIn PDF document text
- https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_051637208140407eaacc159d6b6f5b2b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vitelitubovuluj/72078123342.pdfIn PDF document text
- https://s3.amazonaws.com/xamibebulosaxug/sevuwu.pdfIn PDF document text
- https://89f68ddc-9f98-4e60-8afa-3e0ca6603e9e.filesusr.com/ugd/4725f1_68fbbd1118ca4644ab913b03d5391e36.pdf?index=trueIn PDF document text
- https://8a89c5bc-485b-4808-980c-66c60e8d9908.filesusr.com/ugd/834936_d5a40461ecf046d5b5f84c32cbbd18d9.pdf?index=trueIn PDF document text
- https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_05a3b6be271042c68b584a40cd9d7cca.pdf?index=trueIn PDF document text
- https://46c0acaa-de7d-4f46-84f0-c2cf1d8ff7d9.filesusr.com/ugd/ac1638_39102af2a27e4c8fb85d73a5381c7084.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f31c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF31C	5120 bytes
SHA-256: `101e42a66608ec4abcdc68896efce3ef5ca43f0a81a1607599801a7dc72b97ec`
`font_01_sfnt_off00010495.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10495	10912 bytes
SHA-256: `6fa8bfccc7b51af1587aaed04494c675989a4dd6036f8fc247e7117f92c2a4c7`

Open this report in the interactive analyzer, or submit your own file for analysis.