PDF malware analysis — malicious · e9aba0349213e271

MALICIOUS

PDF

78.4 KB Created: 2021-06-06 02:37:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25

MD5: 38509907552679117913aabbd2686b0e SHA-1: 4747ef1965213a7258a2ec2469803d6245dad8f1 SHA-256: e9aba0349213e2715498963169aaf674f610c28e14bad99a804f281e85e9fc4f

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to PDF files, suggesting a link farm or SEO poisoning tactic. One of the primary external URIs, 'https://ketchas.ru/pbw?utm_term=the+lies+of+locke+lamora+pdf+reddit', is suspicious and likely leads to a phishing or malware distribution site. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ketchas.ru/pbw?utm_term=the+lies+of+locke+lamora+pdf+reddit PDF link annotation
- https://tigizojotajubum.weebly.com/uploads/1/3/4/4/134489046/guzopi.pdfIn PDF document text
- https://bozuzagon.weebly.com/uploads/1/3/4/6/134666742/zavotiwef.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417403/normal_600e9008c2ed0.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4403413/normal_5fd090cc393cc.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4466165/normal_6003edd1d893b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450732/normal_604886811f16f.pdfIn PDF document text
- https://dudunetexuzo.weebly.com/uploads/1/3/1/3/131379759/dopeza.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4468572/normal_5fdc96bef27bd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462339/normal_604412f14c00c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4419628/normal_5fd84e1f76fca.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4418970/normal_5fe46854a7550.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4448332/normal_600909ab2273d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4491169/normal_602fc028b6844.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383302/normal_600f93da8f9b6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4467287/normal_603278074355e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413002/normal_60bbf7838438b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/d74a6615-aee1-43e2-811a-7847de613ceb/tartine_bread_pudding.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bf757081-3940-462d-bcb3-bfefd00ebc4e/how_to_report_bike_theft_to_police.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b083b3ee-1ac6-4d0d-91cf-ebebeb0341a5/lijitedegijoburez.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4be97091-25eb-4b09-b6fd-7f5547acccf6/barifovuzakidid.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e2e9672e-52cc-475f-a63b-d4d912f29155/fundamentos_de_marketing_william_j._stanton_mcgraw_hill.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/684d88d7-d8bc-4282-ae92-df0693341e47/korean_alphabet_hangul_pronunciation.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/61192b1a-3b4a-405e-a7b5-95c8e33f28f8/temuvarop.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/61a800ca-d850-4416-a09b-05aa117f8cf7/98139543474.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f3c9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF3C9	5408 bytes
SHA-256: `5bad559c07acd3a7f9b8113c8b0331c7357bab7deba14463bdb14b695ec041ec`
`font_01_sfnt_off00010602.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10602	11168 bytes
SHA-256: `909b6fbf61f099d4512ff850938a94638609316dabcbc7c9a941b3ac622b2ea3`

Open this report in the interactive analyzer, or submit your own file for analysis.