PDF malware analysis — malicious · f64e6eec4c37b0cc

MALICIOUS

PDF

89.2 KB Created: 2021-04-08 05:29:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: f15de716bd68895beea94eea755498eb SHA-1: 0b058fcd33541ea77332c0cb23045a12f1d74dd6 SHA-256: f64e6eec4c37b0cc5b894313e91e9422f371e095c37790448c673f85ded8fe2c

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, with a critical heuristic identifying it as a PDF link farm. One of the embedded URLs, 'https://fokemale.ru/123?utm_term=apush+give+me+liberty+chapter+12+pdf', is flagged as unknown reputation, suggesting a malicious intent. The ClamAV detection and ML classifier further support its malicious nature, likely for phishing or distributing further malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9988

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fokemale.ru/123?utm_term=apush+give+me+liberty+chapter+12+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4475861/normal_60115fd452056.pdfIn PDF document text
- https://wukelefitifaka.weebly.com/uploads/1/3/4/8/134882985/fisiwamowoxuse-jiworun-todutites-vexapab.pdfIn PDF document text
- https://lipulutopokun.weebly.com/uploads/1/3/5/9/135964399/vavotilu.pdfIn PDF document text
- http://gojawufeki.getenjoyment.net/17844374768.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4403684/normal_5fee3ad486079.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453740/normal_602c26640373a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414498/normal_60420066a0ef4.pdfIn PDF document text
- http://gejulavofanutar.mygamesonline.org/architectural_plumbing_symbols.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4495846/normal_5fcd64ac83f78.pdfIn PDF document text
- https://zoxiniguve.weebly.com/uploads/1/3/4/5/134584112/41819d1bda2a.pdfIn PDF document text
- https://pulolated.weebly.com/uploads/1/3/0/7/130740140/fosulaletipazu.pdfIn PDF document text
- https://bijoxopibomer.weebly.com/uploads/1/3/4/3/134325560/rikitawibanopu.pdfIn PDF document text
- http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/sorogamat/guzenojazoxazim.pdfIn PDF document text
- https://44407f20-7244-4107-9544-84d8151b6f9a.filesusr.com/ugd/8508de_342420d7ce9645fd8f92958dc828e9eb.pdf?index=trueIn PDF document text
- https://619c993e-e215-4b07-891b-88776ecab8c8.filesusr.com/ugd/1fce43_670ee572d8984a4bbf45523346db1141.pdf?index=trueIn PDF document text
- https://92fbd7ca-8480-4723-bb2c-19523f9dca15.filesusr.com/ugd/29946e_d37b36cde7214036a7344d39667ceefd.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wetevali/vofasovasi.pdfIn PDF document text
- https://s3.amazonaws.com/sorapobuk/free_commercial_invoice_template_australia.pdfIn PDF document text
- http://ratobewiwigu.atwebpages.com/mewimekaru.pdfIn PDF document text
- https://s3.amazonaws.com/nuvukivaxiren/agri_online_form_date.pdfIn PDF document text
- https://71fc3d66-43b2-4ae0-adc3-dfbcdf8b5360.filesusr.com/ugd/6605a0_8fe899ae65fc487e8e8246f60fd53105.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sumesawoxajew/lol_patch_notes_10.23.pdfIn PDF document text
- https://s3.amazonaws.com/rerinago/research_paper_writing_guidelines.pdfIn PDF document text
- https://af1bea64-f5cd-41c2-a7c1-97f21c1aa057.filesusr.com/ugd/592671_ac321140db9946789dd5a38f61128fff.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/ravuxudibure/33013130533.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000114ae.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x114AE	1872 bytes
SHA-256: `223568fc15723d408f00056d2cf6bf73ec0b5e81a44ab038b8d55cfaeb1c3c3d`
`font_01_sfnt_off00011da1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11DA1	6044 bytes
SHA-256: `4716d814ea8f4569b5a3132a83bb3454430d55fe14f8504679423c7bd5ad5b24`
`font_02_sfnt_off0001321d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1321D	10764 bytes
SHA-256: `02b5fc09a838bd8533097861a43ca26e5a8b7255872e459399df3c5c75d6f2f6`

Open this report in the interactive analyzer, or submit your own file for analysis.