PDF malware analysis — malicious · 1e92d8c07d409610

MALICIOUS

PDF

81.8 KB Created: 2021-09-16 17:02:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: abab759deba05f4900f97e807246836b SHA-1: d4cb644be34b7995cba75a52dad1a3ce2ae3445c SHA-256: 1e92d8c07d40961058d23bd63e798353746297f3fd4f27491fdaa17a6d369603

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample is a PDF containing embedded JavaScript, which is a common technique for exploiting PDF vulnerabilities or delivering malicious content. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates the document points to numerous external PDFs hosted on disposable domains, suggesting a phishing or malware distribution campaign. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9952

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://stsmcc.org/www/js/ckfinder/userfiles/files/64091740579.pdf In PDF document text
- http://szyoujin.com/UploadFile/file/20210911190542050.pdfIn PDF document text
- http://webcertain.net/contentupload/fckeditorUploads/organization_/file/juxat.pdfIn PDF document text
- https://aecvfcom.nrgence.com/upload/userfiles/files/35162176674.pdfIn PDF document text
- http://hig-hegmann.de/userfiles/file/57470736565.pdfIn PDF document text
- https://we-plus.tw/ckfinder/userfiles/files/2513678657.pdfIn PDF document text
- https://www.verpoort-bouw.be/wp-content/plugins/formcraft/file-upload/server/content/files/161407a59e8137---71326114079.pdfIn PDF document text
- http://crystal-lamp.ru/uploads/files/4926682622.pdfIn PDF document text
- http://bellezaeimagen.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/16140bb25251b0---jesigidin.pdfIn PDF document text
- https://hv2barrier.com/application/third_party/ckfinder/userfiles/files/32764357151.pdfIn PDF document text
- http://www.samuitns.com/image/upload/File/24908110452.pdfIn PDF document text
- https://fundacjanadzieja.com/images/wyswig_images/file/rolulediwivubagenawe.pdfIn PDF document text
- https://ariaparvaz.com/basefile/ariaparvazcom/files/32677145032.pdfIn PDF document text
- https://www.gryf-wet.pl/ckfinder/userfiles/files/gasazozekokisabadoravokit.pdfIn PDF document text
- http://ozhelalikram.de/resimler/files/sopuvadabojisazirisile.pdfIn PDF document text
- http://to-tuong.com/media/ckfinder/files/rofus.pdfIn PDF document text
- http://tubietelbar.hu/uploadfile/sesanafovadonupogimutija.pdfIn PDF document text
- http://cdenito.net/userfiles/file/47649630898.pdfIn PDF document text
- https://sunkamalzemecilik.com/userfiles/file/21896648027.pdfIn PDF document text
- https://bazab.ru/ckfinder/userfiles/files/77117898292.pdfIn PDF document text
- http://sonhanint.com/uploadpic/sun/files/202109120206203374.pdfIn PDF document text
- http://www.corazondelsol.es/ckfinder/userfiles/files/69524816411.pdfIn PDF document text
- http://smogy.ru/files/files/bupex.pdfIn PDF document text
- http://ttmm.co.jp/ckfinder/userfiles/files/sowobinurefojer.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/BvfzZFkJO3s/uplcv?utm_term=fake+android+devicePDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e1fe.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE1FE	10184 bytes
SHA-256: `a3280be872645e27bc294cd3c7e164c4a422fcb9a8dca82495b61c2a6f69d978`
`font_01_sfnt_off0000f8de.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF8DE	17620 bytes
SHA-256: `6e9141861f9d3a8246c7aafce8bd05fd9c3cc64f75d5dc85e94c8baaccb72529`
`font_02_sfnt_off000126f6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x126F6	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.