PDF malware analysis — malicious · 20ad3a9ac8b81645

MALICIOUS

PDF

82.8 KB Created: 2021-03-27 21:58:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 7b1db96a2e21d6ef87ab9b5a8ac3ecde SHA-1: e71d321c79933d107cc79f719475b6f4d186ca20 SHA-256: 20ad3a9ac8b81645cb6779e30ae25c4e0f61c403c3736ea1b4a7726a99fcccf9

184 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, suggests a lure related to educational materials. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect users to phishing or malware-hosting sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/123?utm_term=rationalizing+radicals+worksheet+with+answers In PDF document text
- http://ipatovaalena.ru/catholic_saints_moviesviyh3.pdfIn PDF document text
- http://fenellalucynelle.info/ribonedopanodutagjgz6e.pdfIn PDF document text
- http://gubevexezu.iblogger.org/mekujenopisul.pdfIn PDF document text
- http://usacreditreport.info/uppababy_vista_double_2018_review9fn4n.pdfIn PDF document text
- http://suruwafid.22web.org/contando_lunares_piano.pdfIn PDF document text
- http://clubstore.pro/bufudarosozuss7j11.pdfIn PDF document text
- http://picply.ru/how_to_replace_solenoid_valve_on_sprinkler_systemiqqjx.pdfIn PDF document text
- http://profaudit32.ru/54475956289nqxss.pdfIn PDF document text
- http://yognat.space/dewalt_dw718_type_1_parts73yj9.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/07f60a4a-2ea7-4308-bcb0-525c992f865a/2273980620.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa4b0f37-8c4f-4d7c-94c4-2747f869b83e/18660311348.pdfIn PDF document text
- https://8ecf7690-1f99-4e28-a4b6-3228ba9731d7.filesusr.com/ugd/63d3ad_7fdad19bb5434381a127852452600d9d.pdf?index=trueIn PDF document text
- https://1e35b969-1f99-48dc-8aa8-d0fb9638bdc8.filesusr.com/ugd/970baa_ae17c36376ca495ea566c547d7490bb0.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/rodiligarexo/4127257505.pdfIn PDF document text
- https://s3.amazonaws.com/tufitijinexu/longitude_and_latitude_worksheet_ks2.pdfIn PDF document text
- https://s3.amazonaws.com/limepusotanal/gefamujuropijewomugen.pdfIn PDF document text
- https://2b08c346-38d8-4763-b559-bb9d4fff2313.filesusr.com/ugd/40c9d6_707f6cc6005a40f191bb2c2ff9459a2b.pdf?index=trueIn PDF document text
- http://kalilom.epizy.com/77941982513.pdfIn PDF document text
- http://nodikisiti.rf.gd/buku_identifikasi_gastropoda.pdfIn PDF document text
- http://dusiwesidixe.epizy.com/bacteria_structure.pdfIn PDF document text
- https://1ceef7f3-d523-4f80-a0a4-3aed54d3d17a.filesusr.com/ugd/48841a_7b88e37aeb11484187aca853c42fdb60.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vunizi/bright_futures_parent_handout.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f8f9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF8F9	5200 bytes
SHA-256: `83871b3913fbf11b122e42a6744bdb064cd3b071f0be7c500beb681cd2ac6281`
`font_01_sfnt_off00010ab7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10AB7	10828 bytes
SHA-256: `c672f2fe562c2ba8689d2616954edf43bb580fbb59788942b67aa9146de26073`
`font_02_sfnt_off00012f93.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12F93	4324 bytes
SHA-256: `4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3`

Open this report in the interactive analyzer, or submit your own file for analysis.