PDF malware analysis — malicious · 097456e780634fae

MALICIOUS

PDF

80.4 KB Created: 2021-03-28 05:23:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21

MD5: a3e0093d4f7277d3bc7a05b851a23bb6 SHA-1: 723b34a5ee95399e635cc355c5d0ae38b2b10905 SHA-256: 097456e780634fae1d71fd7d25e3a4cf603f260148c5cea17054c89aade796ca

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with one prominent URL suggesting a lure for downloading content. The presence of PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates a link farm on disposable hosting, further supporting a malicious intent to redirect users to potentially harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9957

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://baarspo.ru/award?keyword=hunger+games+2+pdf+free+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4460266/normal_5fda731815c64.pdfIn PDF document text
- http://mebelintera.ru/kirtley_sheet_metal_tomball_txflld6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460447/normal_603e66909131c.pdfIn PDF document text
- http://andyhong.blog/see_messages_from_blocked_numbers_androidpay5v.pdfIn PDF document text
- http://zokiwedilar.mypressonline.com/12164569538.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4407084/normal_604a3fdd99b12.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4497697/normal_60353617c4b11.pdfIn PDF document text
- http://bixaxivajujojar.mypressonline.com/world_stock_market_futures_for_tomorrow.pdfIn PDF document text
- http://lezobul.medianewsonline.com/gojesizudaxerusa.pdfIn PDF document text
- http://serdyukov.pro/forcing_conflict_management_style_examplev47d6.pdfIn PDF document text
- http://purpless.vip/bollywood_film_mp4rytb3.pdfIn PDF document text
- http://bagabipum.iblogger.org/18298972777.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4458826/normal_5ff4973198a14.pdfIn PDF document text
- http://vakekaninu.iblogger.org/aislantes_conductores_y_semiconductores.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379723/normal_604ce488415a0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485702/normal_605cf3535a0c2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4458390/normal_6030a07a4df0e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417643/normal_601246a29ce88.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382189/normal_5fd829381f240.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6c0cbc26-df8d-44ae-9f67-ec9613a8255b/boted.pdfIn PDF document text
- http://pidusagi.atwebpages.com/dirugezoxub.pdfIn PDF document text
- http://toraxetutat.epizy.com/wametigox.pdfIn PDF document text
- http://jinugiwi.atwebpages.com/41680194574.pdfIn PDF document text
- http://womirejosowasu.epizy.com/how_to_read_chemistry_textbook.pdfIn PDF document text
- http://xawabaxazulaga.epizy.com/process_performance_qualification_protocol_template.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e2a5de9-5c26-4a9d-a232-0bc2a1d2cf88/lg_hbs_912_firmware.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/13417eb9-183c-4ce6-92fe-68e5597b7ca4/43171201334.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fbbe.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFBBE	5544 bytes
SHA-256: `ed1829feff7b173a68361bc330b7bb4c6783d5dd32e9c9225e70cbf41ce7fe4d`
`font_01_sfnt_off00010e9d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10E9D	10812 bytes
SHA-256: `b10f8c31c54f828e4d45e17487013952d2e0fafaf294d6923112d5f581afa77d`

Open this report in the interactive analyzer, or submit your own file for analysis.