PDF malware analysis — malicious · f08bd7f02345a522

MALICIOUS

PDF

91.3 KB Created: 2021-05-11 15:18:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23

MD5: 5dbf48f8d918a8294660642c84d2ace6 SHA-1: 13cc2fb4dc90428d9b6608212958a96cafd78912 SHA-256: f08bd7f02345a5222f07f82c7fb93bb97381f5adbbc79308395fb60adca1e4b5

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. It contains a large number of external links, suggesting a link farm or phishing lure. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest an attempt to direct users to potentially harmful websites.

Machine Learning

Nyx PDF Classifier malicious score 0.9955

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/strik?utm_term=poulan+1625+electric+chainsaw+parts PDF link annotation
- http://cmb-accueil.com/can_you_use_bluetooth_with_roku9uxc9.pdfIn PDF document text
- https://cdn.sqhk.co/lobinazema/Ocwjj0C/triple_diamonds_slots_no_downloads.pdfIn PDF document text
- http://car-test.pro/4334930811bpi2u.pdfIn PDF document text
- https://cdn.sqhk.co/rewaloxuruvu/4POgb2c/lube_max_express_coupons.pdfIn PDF document text
- http://randname.ru/how_to_control_tv_volume_with_optimum_remoterrku0.pdfIn PDF document text
- https://cdn.sqhk.co/manuguwe/26hvdgc/monster_chef_spirit_stone.pdfIn PDF document text
- https://cdn.sqhk.co/kesavaki/ajaciaW/skull_arena_idle_hero_rpg_mod_apk.pdfIn PDF document text
- http://italdom.fun/zalalekedofatifd7pv.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/xapijifas/85204812177.pdfIn PDF document text
- https://s3.amazonaws.com/sudevejerifu/autocad_2013_free_32_bit.pdfIn PDF document text
- http://turojupa.epizy.com/java_tutorials_point_download_free.pdfIn PDF document text
- https://b1706aec-e9b1-4c6c-9a93-f14ef4a1c402.filesusr.com/ugd/3b47cb_ac04a49d4cc04ee6a78d8aeb94bdac72.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sepovutapakogaf/sutepulinumokukoger.pdfIn PDF document text
- https://s3.amazonaws.com/lerezazo/twilight_new_moon_movie_in_hindi_watch_online_free.pdfIn PDF document text
- https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_43e6cddd317d423594b236a72a3ceb04.pdf?index=trueIn PDF document text
- https://b7eb3c74-9f10-4efd-a612-efb7ea03662f.filesusr.com/ugd/7198c1_5370e8a203c1477ca6a897b517366cb7.pdf?index=trueIn PDF document text
- http://dagimasara.epizy.com/kit_aromatouch_doterra_espaol.pdfIn PDF document text
- https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_df8c8bd1149c4eaa96400a4a6de3286d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tugumeb/wotefitudunudizuvu.pdfIn PDF document text
- https://s3.amazonaws.com/jamuluvuvava/avery_weigh_tronix_zm303_calibration.pdfIn PDF document text
- https://932aa67c-856a-4fda-9fc8-fe3f50d4acc2.filesusr.com/ugd/a25eee_7fdd7276d83a4ed5ab796e79b75fd9fa.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xilasisefi/lakuge.pdfIn PDF document text
- http://dovudegumigisaw.rf.gd/conclusion_for_lab_report_measurement_and_uncertainty.pdfIn PDF document text
- http://pozonijegexovu.epizy.com/tanejumanupudokozutin.pdfIn PDF document text
- https://s3.amazonaws.com/tigewibejageju/potugevilipoke.pdfIn PDF document text
- http://zazozipuse.rf.gd/denemoxuvaxokukisasu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000116da.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x116DA	5456 bytes
SHA-256: `a1c234cefffbe04972e5ef323eb68c9d5a8b58967058d91c6ea356723e2f82a2`
`font_01_sfnt_off00012971.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12971	11860 bytes
SHA-256: `83c244828514bb9e623f6522312ad4e20e1efabe85602ca8514e1801e0444907`
`font_02_sfnt_off0001515f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1515F	4324 bytes
SHA-256: `7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71`

Open this report in the interactive analyzer, or submit your own file for analysis.