PDF malware analysis — malicious · e6100e32ee914407

MALICIOUS

PDF

81.4 KB Created: 2021-03-18 13:30:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07

MD5: 6964e13c5497a30bf8952105810c5648 SHA-1: 409cc579181d1ce1024215048e547740e55a3abd SHA-256: e6100e32ee914407e4efb560b4f42e6826df38c7066461ace33531a028a4765b

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDF files, suggesting a link farm designed to manipulate search engine rankings for software downloads. The presence of ClamAV detection and ML classification as malicious, along with the PDF_SEO_LINK_FARM heuristic, strongly indicates a phishing or malware distribution attempt. No scripts were extracted, but the overall structure and URL patterns are consistent with a phishing lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://soxebez.ru/wix?keyword=3ds+download+apkpure PDF link annotation
- https://nexevakef.weebly.com/uploads/1/3/5/3/135327015/8879171.pdfIn PDF document text
- http://salizurewaki.mypressonline.com/pdf_acrobat_reader_for_windows_8.pdfIn PDF document text
- https://nipoxumafoji.weebly.com/uploads/1/3/4/7/134717148/lidepu_deluvu_numapaxe_fetujiw.pdfIn PDF document text
- https://jesipawuba.weebly.com/uploads/1/3/0/8/130874316/pitatekesa.pdfIn PDF document text
- http://serururepus.scienceontheweb.net/como_se_cita_un_autor_corporativo_apa.pdfIn PDF document text
- https://sobexezawatu.weebly.com/uploads/1/3/4/9/134903145/b529b3274849390.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/1dd42bd9-8e8f-4f16-abf6-918b9ed4843a/gexogatenuxafamasejepa.pdfIn PDF document text
- https://7be326e9-a1fd-4761-a84c-83c904220737.filesusr.com/ugd/37e945_613cc36b2d97407596345b862836f7dc.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nuxomigo/86640561670.pdfIn PDF document text
- https://s3.amazonaws.com/seriposuj/10484496090.pdfIn PDF document text
- https://ec5c17a1-061e-4a2c-a9e6-b3561ba71229.filesusr.com/ugd/299074_de56346d2a264c419a49e1b81f78a296.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3ed62b3f-8fb7-4fc7-8ac4-ec3d473e18c6/tifegegudozuxowoguwev.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/257f8c4f-acbb-4022-8986-e600ab54aece/invisible_man_suit_2020_trailer.pdfIn PDF document text
- https://s3.amazonaws.com/saziwijaxodav/cabo_san_lucas_fishing_report_august_2018.pdfIn PDF document text
- https://s3.amazonaws.com/sejakopa/spotify_windows_8._1.pdfIn PDF document text
- https://s3.amazonaws.com/lomuper/90993768715.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/06af6670-59cd-4f96-94cf-f7cf027b5fc0/gonesi.pdfIn PDF document text
- https://s3.amazonaws.com/tutasujal/secure_vpn_free_for_windows_7.pdfIn PDF document text
- https://631ffb88-cf2d-4844-8d6b-9338a1b21cc5.filesusr.com/ugd/d24e6f_6c40e2211f344c199302c1f3515b22dc.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/negonanopix/screenshot_windows_10_app.pdfIn PDF document text
- http://danebusuji.onlinewebshop.net/gulobolotulodutakigas.pdfIn PDF document text
- https://s3.amazonaws.com/jajuzasalikirut/jogedazewipifemi.pdfIn PDF document text
- https://s3.amazonaws.com/bulalowisu/39382197907.pdfIn PDF document text
- https://s3.amazonaws.com/fisulefajow/65699111461.pdfIn PDF document text
- https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_405f8a5e63a14d7897eec682a5f178d6.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e231.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE231	9972 bytes
SHA-256: `d615f0d72f87a2c15c450f3e9ce4fefba08bbf14c3a6eda6c0ca5d151b6cd075`
`font_01_sfnt_off00010194.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10194	5180 bytes
SHA-256: `ca9a2e8bce1739cd78c3f854b78b053cca7695af121ae1d6fea72d43ba4b9fe7`
`font_02_sfnt_off0001134c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1134C	10588 bytes
SHA-256: `01f866380c3e49f04a2503e65e08a28925c81f842002574436930ce5b020bcf0`

Open this report in the interactive analyzer, or submit your own file for analysis.