PDF malware analysis — malicious · ecc27d6c8f1e4816

MALICIOUS

PDF

77.2 KB Created: 2021-06-08 20:13:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13

MD5: 26d9aa72bf3c9dc4d5d3b873775b9661 SHA-1: ab4d294d81a2461f2bec842054c0e500e5b7b6f8 SHA-256: ecc27d6c8f1e481699ed37b4019ece4c3a034f4b2aba2fc7d6e08ee70c6157bb

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that masquerades as a song download, which is a common lure for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, with ClamAV identifying it as a phishing trojan. The presence of numerous external links, including the primary malicious URL, suggests a link farm or redirection mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.9753

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crewmak.ru/pbw?utm_term=download+abcd+2+happy+birthday+song PDF link annotation
- https://cdn-cms.f-static.net/uploads/4455179/normal_602d7778153ba.pdfIn PDF document text
- https://bevatisaxotel.weebly.com/uploads/1/3/4/3/134378436/2387776.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383695/normal_602c04a39c5f6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4455174/normal_5fdec78725d38.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4391620/normal_6009c0e6192fa.pdfIn PDF document text
- https://mosuvixixe.weebly.com/uploads/1/3/0/9/130969854/3986211.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387709/normal_6019512f8d976.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4b940c35-577b-43c9-a53c-24d07ef76655/yamaha_ypg_635_display_problems.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e476fba5-61c4-4d04-90f1-6a5b86209578/lizekamaridu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee09efad-624f-4610-b570-137fc1412928/why_cant_i_share_someone_elses_post_on_facebook.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/57c227cc-e40f-481a-822c-7418d587cb42/hp_deskjet_2547_scannen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e3fa69c-f256-4227-be11-005f583f215f/sodapejokugitaniz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/207a8001-5d1c-4030-aba7-68fb8914249c/97433994345.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/297b66a8-1b06-4b6d-ae47-a301253941f0/jumixururi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2ece8368-adf4-45aa-8ea8-0553120f389e/how_to_draw_female_anime_poses.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa562bdc-7742-4e99-acdb-f1b961c86d08/heil_heating_and_cooling_systems_reviews.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fca6027d-aa99-45a9-8913-3fb1cd3c0064/65736416337.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b73daaab-a56f-4efd-b73d-9e8474612c53/kuravax.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f73c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF73C	5800 bytes
SHA-256: `ffdffb2bf06f63fbe8f5edc8254735386ae25928c53ce8cea0675791ef65e02c`
`font_01_sfnt_off00010b0e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10B0E	10744 bytes
SHA-256: `86cb6612e3c492c1a6e39f645b4a740f8cc9dc40635bb4416700ce046606e36e`

Open this report in the interactive analyzer, or submit your own file for analysis.