PDF malware analysis — malicious · f5fa4e8c7145afc3

MALICIOUS

PDF

82.6 KB Created: 2021-03-15 08:51:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30

MD5: 33c3610adeaf98ed39ce80c4d7f03326 SHA-1: 1fa97b3fe140a7614832b431ed26b1c048d15744 SHA-256: f5fa4e8c7145afc3727e30508623543e869b56edef32f83417c6b0a7dd0f8ae8

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to PDF documents, suggesting a link farm or SEO spamming tactic. The primary URL, 'https://lozipotod.ru/123?utm_term=ip+address+hider+free', indicates a potential phishing or scam lure. ClamAV and ML classifiers also flagged this file as malicious, specifically as a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://lozipotod.ru/123?utm_term=ip+address+hider+free PDF link annotation
- https://cdn-cms.f-static.net/uploads/4461786/normal_604ce61b4d9d9.pdfIn PDF document text
- https://topukutenikoxi.weebly.com/uploads/1/3/4/6/134668920/6255142.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4404124/normal_6021876765814.pdfIn PDF document text
- https://zevebijupaxize.weebly.com/uploads/1/3/4/7/134754497/galipunude.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4503309/normal_5fdffaa992304.pdfIn PDF document text
- https://cdn.sqhk.co/sabiseleto/dsYXRhb/foosball_coffee_table_amazon.pdfIn PDF document text
- https://lumamiwaba.weebly.com/uploads/1/3/4/7/134735329/bupukejemoku_fidabura.pdfIn PDF document text
- https://cdn.sqhk.co/zivugeri/jgAjbgj/11483385014.pdfIn PDF document text
- https://cdn.sqhk.co/wofikubid/7OgcghU/wejevowojugetawubuwemape.pdfIn PDF document text
- https://cdn.sqhk.co/remozemot/j4Jighe/irunner_game_download.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468531/normal_602c115926145.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4457561/normal_5fe7cf7ae0e67.pdfIn PDF document text
- https://pugotaba.weebly.com/uploads/1/3/5/3/135302821/badizenuri_fudivubonofo_pebaberu.pdfIn PDF document text
- https://vomediwanuxorat.weebly.com/uploads/1/3/4/3/134327005/tezujulogapinaziv.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://98748e4b-3258-471a-903e-8ea98415cca0.filesusr.com/ugd/fd7405_2e852b3b8272485ca84ece3254d06ea7.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jujojomojemiz/tefuwukikonaxam.pdfIn PDF document text
- https://s3.amazonaws.com/fojaxexino/mandiri_e_cash_apk_versi_lama.pdfIn PDF document text
- https://170a7d3c-74f0-42f5-9ead-98ae292a4922.filesusr.com/ugd/a18aa6_149bcba4f9e04cb2811e363fb92a729a.pdf?index=trueIn PDF document text
- https://dca540c6-954d-4243-9f09-0921753db957.filesusr.com/ugd/974a4e_6165432be1fb4edaa69d73a6cd454720.pdf?index=trueIn PDF document text
- https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_623ff77d74f2430b8cc79e913fa6a370.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sazomo/opencv_edge_detection_android.pdfIn PDF document text
- https://s3.amazonaws.com/xalasawu/negofimivakalamuze.pdfIn PDF document text
- https://2a4b29e6-a790-453e-81e7-e8b9caf2c27b.filesusr.com/ugd/bf0735_b2df21d43d084220a13f412c9e74fcd9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jukoxisojow/informante_ciudadano_facebook.pdfIn PDF document text
- https://1a2149e7-ca7f-4e7c-a584-0e483de6f3af.filesusr.com/ugd/9219f8_b5c370e84c9d45c192036c59bdf7c667.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fa97.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFA97	4528 bytes
SHA-256: `7dbcbfdc75196c78c738a03e6cc2a375c7ae4f91f232121b0f14c74b6f37ede8`
`font_01_sfnt_off000109f4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x109F4	10648 bytes
SHA-256: `2843c92bc0d2569ccc0b3dc7f0a03f1854a8439599ba386cf795a2d0ce63f9c9`
`font_02_sfnt_off00012e5c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12E5C	4324 bytes
SHA-256: `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`

Open this report in the interactive analyzer, or submit your own file for analysis.