PDF malware analysis — malicious · ec4c2f578a81b2a5

MALICIOUS

PDF

126.3 KB Created: 2021-03-18 18:07:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23

MD5: 41b27a9b60ceb02a0b5d797cb26b4004 SHA-1: a2541a99fb3b0f2df478a6cc94bba868b945bf77 SHA-256: ec4c2f578a81b2a5a8e032926cd5a09f0ca9ff79502720052c00651de095c312

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO link farms or phishing lures. The primary external URL, 'https://fokemale.ru/award?keyword=aspectos+biologicos+de+la+sexualidad+pdf', suggests a pretext to drive traffic to a potentially malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a high likelihood of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9976

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fokemale.ru/award?keyword=aspectos+biologicos+de+la+sexualidad+pdf PDF link annotation
- http://ipatovaalena.ru/rigugebodavesirakemq6pte.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4464077/normal_602c62c043178.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366668/normal_601791ff51269.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4493221/normal_6017392426213.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380863/normal_6044670270b61.pdfIn PDF document text
- http://teksalle.xyz/free_printable_world_map_for_studentsht7iy.pdfIn PDF document text
- http://masalev.ru/sodastream_instruction_booklet4d69d.pdfIn PDF document text
- http://keep-travel.com/profit_plus_administrativo_manual4mwrb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4391305/normal_5fe9ed6dc30f5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/juduk/52932444419.pdfIn PDF document text
- https://s3.amazonaws.com/wupagivoz/atmos_vape_manual.pdfIn PDF document text
- https://s3.amazonaws.com/bufexa/80025102158.pdfIn PDF document text
- https://df1d5e35-4e67-4e57-ba41-6141a32c4ecb.filesusr.com/ugd/c54278_0e5882f621fb48a9982a098f2a417711.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/miledu/jakesipa.pdfIn PDF document text
- https://2c91b947-1dd8-401e-ae91-d595f2f75867.filesusr.com/ugd/0af078_e29eaabd202c41e9836cb26817ecf8da.pdf?index=trueIn PDF document text
- https://9e269ae7-c3cf-4b9f-bde2-1d9be064b7bf.filesusr.com/ugd/139869_9e8dce5bd9f5452094ecf5d6edb543f1.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tufujifinobiro/38080501161.pdfIn PDF document text
- https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_c1449c1a7c6b46b297a94c1f0fcad07a.pdf?index=trueIn PDF document text
- https://2c9641c8-5874-4869-9b94-f1378e60aa6b.filesusr.com/ugd/efc1f6_2d246e1144314843afdcb9706844e4f8.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xomepixo/gidumatejebuda.pdfIn PDF document text
- https://1a6defe7-92a0-4357-8a70-d3bce85d30c9.filesusr.com/ugd/385065_99af0a1da6ff4000b4f51d67a7fba951.pdf?index=trueIn PDF document text
- https://5926284e-b61c-4ed0-95e5-27b9feedd2c3.filesusr.com/ugd/50c35f_9027472f311d4ebba9c37934d57853ef.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sigobija/ionic_bonding_worksheet_and_answers.pdfIn PDF document text
- https://78fc25e8-d533-4ec3-a480-3617e8cc0d4b.filesusr.com/ugd/aa5866_156df7821f274666b287b05564790e65.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sitozi/11324865399.pdfIn PDF document text
- https://5a8aee2d-3d68-4c09-98ed-743c9c56d6fd.filesusr.com/ugd/460efe_3378301e10c14835aff057a025c935fe.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001ac9f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1AC9F	5424 bytes
SHA-256: `6a829ab338238687fca7a83b232e6bf358c5b693c4e1a2d54b9b6d673d4632b8`
`font_01_sfnt_off0001bf2a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1BF2A	13316 bytes
SHA-256: `78f3df92adfcdff29aa656d68bab69341872ad76e7f530cd4ca325cd97ba979c`

Open this report in the interactive analyzer, or submit your own file for analysis.