PDF malware analysis — malicious · fe17d0d452724ce0

MALICIOUS

PDF

80.6 KB Created: 2021-03-24 22:10:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1a92e804f0fe9b19972175ba85ea0786 SHA-1: 2ad96cf19ce7c48f995fe320cba4510c15efcb23 SHA-256: fe17d0d452724ce06a585e807b94993a504ff0612a8267f6725fce0a6089ab3f

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, suggesting a link farm or phishing attempt. The primary malicious URL identified is https://pelibifir.ru/wix?keyword=kik+apk+hack. While no scripts were explicitly extracted, the PDF structure and link farm behavior are indicative of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9950

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pelibifir.ru/wix?keyword=kik+apk+hack
- https://fatuwotivefog.weebly.com/uploads/1/3/0/9/130969768/0b7a473f8759f.pdf
- https://xebolefijepipol.weebly.com/uploads/1/3/0/7/130739937/61c35fb.pdf
- http://svoydvalend.xyz/teorema_fundamental_de_la_numeracinxn1y9.pdf
- http://italywow.info/minecraft_pc_apk_1._14y949e.pdf
- https://lazevipabeba.weebly.com/uploads/1/3/4/7/134712462/pobizexapofak_denudonuzu_tusubogav.pdf
- http://regvoolkim.website/lalorununezotedo0ypv7.pdf
- https://kezorida.weebly.com/uploads/1/3/5/3/135330530/zudekilibudijetut.pdf
- https://wewogubebomev.weebly.com/uploads/1/3/4/6/134692169/duridupivaduwaxo.pdf
- http://anbieterbewertung-autoscoutch.com/wills_eye_hospital_emergency_roombccz7.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://5121d360-3808-4f61-aa44-d87cf2d9d428.filesusr.com/ugd/032e8a_dd3c5944d5c6448f8416f44249b9cb05.pdf?index=true
- https://d89a15f7-21b5-45f0-b9b4-bc5b7be68842.filesusr.com/ugd/18e821_36ea979fdc31401c8662729dcba58caa.pdf?index=true
- https://uploads.strikinglycdn.com/files/03fa50c7-5389-41ba-85a8-2adf30c3f79b/how_to_use_traffic_light_in_excel_for_text.pdf
- https://d5bea983-5bca-41ba-aae6-6b688785cc77.filesusr.com/ugd/9ec29b_edaaf1ae052f474cb012b98abb704b42.pdf?index=true
- https://fb79ad55-22b5-4823-9538-35c71bbbd514.filesusr.com/ugd/ea423f_87d73acd6d864b91904934a4592b18ad.pdf?index=true
- https://8bd0dbf5-62e0-4684-a95a-1d9666dfa34a.filesusr.com/ugd/e71694_628672d52e0447c9b2f686f2f701eb62.pdf?index=true
- https://d05b2b94-0af3-401c-a6ef-75d00d0b58ae.filesusr.com/ugd/3bca44_f2dfc78a3890457ea76d8d6329065e1d.pdf?index=true
- https://538d8494-0c7d-401a-b890-0485f6bc7bca.filesusr.com/ugd/29c71c_4b21bfcd08d3440a9c8981086b164283.pdf?index=true
- https://uploads.strikinglycdn.com/files/af0b5f85-31f9-45af-8a38-de103895061a/where_is_lemony_snicket_now.pdf
- https://eff7b67d-fef5-45b7-bcd6-ffb1b71d3a14.filesusr.com/ugd/b4c9df_85ad2e4a018c4fee9e9094d62b3f75d4.pdf?index=true
- https://uploads.strikinglycdn.com/files/872fcca8-33cc-411e-8e8e-fc9f24f7deea/make_the_road_by_walking.pdf
- https://bd7a0a6f-bbfd-49cc-ba41-c3f2778102d9.filesusr.com/ugd/9ea91e_5a0a1c728b4f49ae8114b9af23293774.pdf?index=true
- https://uploads.strikinglycdn.com/files/a982a22b-f050-4282-895f-6d849bf491b2/fasefusogap.pdf
- https://91313464-3f42-441e-b0e8-b27065d471ad.filesusr.com/ugd/ee9d3f_2d903497cba740e096f21b61e1db505e.pdf?index=true
- https://1d812fcc-cfc3-4558-a870-56fc5b7f4c2e.filesusr.com/ugd/754d94_8c40a2ed7e5a491b974225968c1459b2.pdf?index=true
- https://uploads.strikinglycdn.com/files/07c69ecb-d86f-4500-ae99-9b6871ea95fe/does_the_ring_security_system_have_a_siren.pdf
- https://8319d365-0190-44ee-b2f3-e76f6fd230eb.filesusr.com/ugd/112488_14880447c9c64e949039da3f97e1bfff.pdf?index=true
- https://2a1457bb-a4d2-449b-8914-d784a503a6da.filesusr.com/ugd/c0fca2_1613f33c51844cf7bae5324fc390c581.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f75d.bin` `25f503b3b3fb8fd7978be02e2f81c255065f9eea85e94bc4c78714a1a925b109`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF75D	4748 bytes
`font_01_sfnt_off0001077a.bin` `daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1077A	1800 bytes
`font_02_sfnt_off00011008.bin` `49f64495f480cc1853cb706bb6604894dc105ade11f1057996039005ec272c53`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11008	10688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.