PDF malware analysis — malicious · 0282ecd9902b5ea1

MALICIOUS

PDF

77.4 KB Created: 2021-03-30 06:09:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 96549f28f9778d006ca8f98e86187808 SHA-1: c24095369ba0d216fe7e42ac96eed135424e5483 SHA-256: 0282ecd9902b5ea1d66a13ee344ad2c39be9106c08d7f97c4537064adfc6be9b

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious intent. It contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain that appears to be part of a link farm designed to trick users into visiting potentially harmful sites. The PDF's structure and content suggest it's a lure for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/award?keyword=alimentacion+y+nutricion+libro+pdf PDF link annotation
- http://kuvewumewatono.22web.org/how_to_make_a_minecraft_server_without_hamachi.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a175e69b-1d1b-4f70-b705-5fcf22d61614/29423104304.pdfIn PDF document text
- https://3ecb585b-79b8-4502-8567-d9a17299c5c1.filesusr.com/ugd/4b874d_2b742516015a49de98e66200b049e5b8.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lawakux/crimson_tidestallion_guide.pdfIn PDF document text
- https://s3.amazonaws.com/jukoxisojow/docker_ubuntu_18._04.pdfIn PDF document text
- https://28546a20-d0cc-4b82-bb4f-6711990cd5a3.filesusr.com/ugd/0bcf16_1f18f3f557cc432488ce5a34642c10c4.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/5dfddc5e-be30-4f4d-bf7d-16ce6eb9ddb4/peseje.pdfIn PDF document text
- https://44407f20-7244-4107-9544-84d8151b6f9a.filesusr.com/ugd/8508de_06a9fb7d5d5c4aa48c1d3fdb00995c24.pdf?index=trueIn PDF document text
- https://64f1e6a9-4530-4009-9f9b-67b91dd69f79.filesusr.com/ugd/76b6de_efab62e121624c1cb2bd8d51860aac41.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0224749d-18bc-4fc6-b2f0-6fa699cb547d/movigagujatulabajimexo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e9d36dab-79a6-4e3a-a00c-ece1fa66816a/56174633709.pdfIn PDF document text
- https://2a082fd4-e93f-4b8e-9e59-408fa046b31c.filesusr.com/ugd/e334dd_6ad9cd8f340a479ba9add0195421a490.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/midaguvimabof/critical_ops_mod_apk_1._9.pdfIn PDF document text
- https://cfc603e6-7cd4-4c42-812b-9722deb80ae4.filesusr.com/ugd/0e9fc2_8a8599793f224d298bcde772a5ee8b13.pdf?index=trueIn PDF document text
- https://275320ff-96dd-455a-9699-a0fdc58b27a5.filesusr.com/ugd/943725_06342260cdb64e93862e0a835fdcd89c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/34aa4265-68ce-44b1-9aca-d33e76491d68/guide_to_getting_it_on_unzipped_book.pdfIn PDF document text
- http://mapuxudenulusa.epizy.com/45814718432.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/22293fe4-632e-4d7b-836c-9bffcf8d1724/2778791137.pdfIn PDF document text
- https://b0c090b1-cb02-46d8-8a69-3fb9d82636b6.filesusr.com/ugd/4dbf3f_43c97b61170545c6a76194d719f24e5a.pdf?index=trueIn PDF document text
- https://24451074-f53b-4065-993c-779ba3957988.filesusr.com/ugd/0ae25f_00be8e6c6d7c428f91d043a1db522e58.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/efdc9ba3-5d8c-4399-b634-5650aa3bd026/71254049095.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ed02.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xED02	5356 bytes
SHA-256: `1577caa5ab424771a82d72a5ecc2b4ed78b2f6f3225bd04af8ae636d6773ead2`
`font_01_sfnt_off0000ff26.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFF26	12376 bytes
SHA-256: `145f9c3cabd020e5dc5ffd95d1506dd7397b3d9000519916dc7ffdf03fb2922f`

Open this report in the interactive analyzer, or submit your own file for analysis.