PDF malware analysis — malicious · ee467f8ab3266dd5

MALICIOUS

PDF

81.9 KB Created: 2021-04-15 11:57:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25

MD5: 58d6615302c3dcfa9e42814768619957 SHA-1: 28bf1e63d3812b93ce82f6c40e44f2746a93ac2c SHA-256: ee467f8ab3266dd5316518b085a43a307b97ce65b0ed5458dae6eaa4cd781241

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to SEO-optimized PDF documents, suggesting a link farm or content-scraping operation. The primary URL, 'https://midufefew.ru/strik?utm_term=speed+queen+washing+machine+manual', is presented as a manual, likely a lure to direct users to a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://midufefew.ru/strik?utm_term=speed+queen+washing+machine+manual PDF link annotation
- https://static.s123-cdn-static.com/uploads/4393183/normal_5ff82f8f5c4da.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450884/normal_6043963d9dbb4.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4466161/normal_5fcc764b98e8c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4416322/normal_605c1b4c0e7c0.pdfIn PDF document text
- https://cdn.sqhk.co/nupegefozub/ggL9Mgh/90622200166.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425010/normal_605070b3682d0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470828/normal_6056ff0c4d288.pdfIn PDF document text
- https://cdn.sqhk.co/gufezitaxato/icqjcOr/minimal_poweramp_v3_skin_apk.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4422367/normal_5ff8d3946f105.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4473053/normal_5fdb300a96c57.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454055/normal_60697d9f7f7d6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408588/normal_604d60c54126a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/70339a93-0e0b-4f28-8aea-83b5e034ec7c/zilawivu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/128394fd-0574-46c1-93ca-a05d7bcd5a24/ge_profile_microwave_model_pvm9005sj3ss_manual.pdfIn PDF document text
- https://6d4a8fb0-9a8a-4850-8aa1-2b5706121c9a.filesusr.com/ugd/ff2e72_4a367d9d915641a587ddae88dedb46d1.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f0acbe58-0e34-41d1-84f7-073c385af1d5/how_to_pair_iworld_wireless_headphones.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/de2a50ab-9891-4274-9184-8b1c4bcda2b1/bokibotofo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45930bb5-485b-4101-9d17-bdee03e5332e/object_oriented_programming_concepts_java.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/59af836a-2d58-4644-a7ac-a224ceacd723/what_muscles_does_a_jumping_jack_work.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c8556fca-80fe-4fb4-9cf9-bb3f78e5018f/3297718770.pdfIn PDF document text
- https://3064a0a7-8496-4b95-be1e-56094aee372f.filesusr.com/ugd/0cf4b9_df119b04c8a642d79c717ca676429b68.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1afe69e3-c224-4374-91a1-8a4cf3766a1e/moxisetir.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f24b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF24B	5404 bytes
SHA-256: `30a370aae90729f07b85ff02de5e77a9128c7fbfb405fc8c484d67fc8a145397`
`font_01_sfnt_off0001047d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1047D	11084 bytes
SHA-256: `d051b9da69187916414dad77b217e16233f52dc274cca876474f0a090f9580f8`
`font_02_sfnt_off00012a2e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12A2E	4324 bytes
SHA-256: `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`

Open this report in the interactive analyzer, or submit your own file for analysis.