PDF malware analysis — malicious · 05e0d87d2df20bce

MALICIOUS

PDF

78.9 KB Created: 2021-03-17 00:42:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10

MD5: 11949ace2b03c05e895213db3a93553b SHA-1: 44b21eb44c930a51d10ef3161f9c803d4aa3c1a2 SHA-256: 05e0d87d2df20bcecbae69ee24ae9f15ef223d486633842a23392c815b2a38f7

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many pointing to disposable domains, and is flagged by ClamAV as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to 'calculation of mean median mode pdf'. The presence of external URIs and the ML classifier's high confidence score indicate a malicious intent to redirect users to potentially harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9954

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/123?utm_term=calculation+of+mean+median+mode+pdf PDF link annotation
- http://matemepujibad.scienceontheweb.net/alter_ego_plus_3_cahier_d_activits_corrige.pdfIn PDF document text
- http://tebafurunaxinuj.getenjoyment.net/what_bulb_for_neff_oven.pdfIn PDF document text
- http://kuworekokinig.medianewsonline.com/6238046710.pdfIn PDF document text
- https://cdn.sqhk.co/botuvawezej/0dgfrAV/69177171816.pdfIn PDF document text
- http://zonitupupafof.sportsontheweb.net/71513855410.pdfIn PDF document text
- http://vosojivaru.mypressonline.com/talk_to_me_in_korean_level_1_workbook.pdfIn PDF document text
- https://cdn.sqhk.co/vujixete/rcmQije/super_puzzle_bobble_java_game_download.pdfIn PDF document text
- http://businessoutsourcing.org/natedazaxopunetujdbil.pdfIn PDF document text
- http://siwosupegejolop.medianewsonline.com/descriptive_survey_research_design.pdfIn PDF document text
- http://tujukesabegakom.mygamesonline.org/zovusepajefuzam.pdfIn PDF document text
- http://gusevoxuzuwelap.mywebcommunity.org/cvce_words_list.pdfIn PDF document text
- https://cdn.sqhk.co/fojizejoxu/7hgheuT/surat_an_naba_muzammil_hasbalah.pdfIn PDF document text
- http://jarewitof.mypressonline.com/what_frequency_is_the_flower_of_life.pdfIn PDF document text
- http://blaugrana.ru/black_and_decker_rice_steamer_instructions_manuals8rbhs.pdfIn PDF document text
- http://wijasagasipode.getenjoyment.net/sivejaxapudapelifedes.pdfIn PDF document text
- http://wedasuf.getenjoyment.net/netepa.pdfIn PDF document text
- http://xarapover.mygamesonline.org/fingerprint_based_biometric_attendance_system_using_arduino.pdfIn PDF document text
- http://pedagodogiko.getenjoyment.net/am_fm_radio_cd_player_review.pdfIn PDF document text
- https://cdn.sqhk.co/jovowosifo/IoDhi8R/best_cordless_vacuum_cleaner_for_caravan.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://zodofujeki.atwebpages.com/7077762570.pdfIn PDF document text
- http://sazasewugekupej.onlinewebshop.net/concurso_prf_2020_edital_em.pdfIn PDF document text
- http://woranuganavot.myartsonline.com/rejisuvetiwepopakizavipun.pdfIn PDF document text
- http://firiwigisu.atwebpages.com/59867739317.pdfIn PDF document text
- http://likewiwojuxus.atwebpages.com/ruvev.pdfIn PDF document text
- http://xakazasaravi.onlinewebshop.net/organelos_celulares_biologia.pdfIn PDF document text
- http://kutoxinupuroxo.onlinewebshop.net/87742830577.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e848.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE848	4932 bytes
SHA-256: `5d918a7990a6500e257844dc6afb70c3c2b90b6a7f5bfa3d0228dd99c7956098`
`font_01_sfnt_off0000f901.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF901	11296 bytes
SHA-256: `13693f644069ff2487a6632307b2f1e0f9f38a4cb111c49037bda41dbd799299`
`font_02_sfnt_off00011faf.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11FAF	4324 bytes
SHA-256: `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`

Open this report in the interactive analyzer, or submit your own file for analysis.