PDF malware analysis — malicious · 23d0d80c24e2037c

MALICIOUS

PDF

112.0 KB Created: 2021-02-14 18:11:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20

MD5: 04047ced1534651dc702e13405ea1d39 SHA-1: 37c7d8e75cce7f88bdc20b2b8a99a90c14c84d00 SHA-256: 23d0d80c24e2037ce02ab11e3b46856990e1c73df69a0c4c5e2a15b4f1b4e608

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains a large number of external links, suggesting it functions as a link farm designed to redirect users to potentially harmful websites. The embedded URLs and the heuristic findings of a 'PDF_SEO_LINK_FARM' and 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly support this conclusion. No scripts were extracted, but the primary attack pattern involves redirecting users through a network of disposable domains.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://druttle.ru/wb?keyword=a%20c%20c%20ka%20full%20form PDF link annotation
- https://cdn.sqhk.co/dutedape/R0jfUha/border_patrol_agent_killed_wife.pdfIn PDF document text
- https://fuzanageguv.weebly.com/uploads/1/3/5/3/135305388/7305934.pdfIn PDF document text
- https://bomejafir.weebly.com/uploads/1/3/4/7/134725936/7765944.pdfIn PDF document text
- https://gakafapokizi.weebly.com/uploads/1/3/5/3/135319358/36a0cc00e4b80c5.pdfIn PDF document text
- https://marikikugawu.weebly.com/uploads/1/3/5/3/135326377/49bc5cdd0.pdfIn PDF document text
- http://winoraama.space/13998440357zckby.pdfIn PDF document text
- https://xalifabosivibu.weebly.com/uploads/1/3/0/7/130775217/kutim.pdfIn PDF document text
- https://tedofejufada.weebly.com/uploads/1/3/0/7/130775935/dceaa07b.pdfIn PDF document text
- https://bukusafirede.weebly.com/uploads/1/3/4/2/134266240/824656.pdfIn PDF document text
- https://jiwenetitorod.weebly.com/uploads/1/3/5/3/135325203/6255485.pdfIn PDF document text
- https://juxeduwabup.weebly.com/uploads/1/3/0/7/130775558/533d327dd.pdfIn PDF document text
- https://pelabomorifij.weebly.com/uploads/1/3/4/6/134628360/susowosetonajak_jibarafe.pdfIn PDF document text
- http://normal-id.com/numiruloiotx6.pdfIn PDF document text
- http://biomaniix.website/quick_lab_accuracy_and_precision_answers0xl6y.pdfIn PDF document text
- https://pujawemufupu.weebly.com/uploads/1/3/2/6/132680931/tuworuve.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- https://s3.amazonaws.com/nosepevozux/i_m_bored_book.pdfIn PDF document text
- https://s3.amazonaws.com/dofufiri/tamil_bhajans_songs_free.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
- http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001350d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1350D	4900 bytes
SHA-256: `62c1aafd3fd3639479c78bcf4cc8f590674f7bb0c8aa944f8a3a6384af020e11`
`font_01_sfnt_off000145a7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x145A7	3720 bytes
SHA-256: `6539b129c5cd894636dc8f40f53a156c00c8f46378ab4f137c96d687a1cff6ed`
`font_02_sfnt_off0001510a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1510A	10472 bytes
SHA-256: `bf35d9ef6372299c064edff88e45f3e7af6b5c267dd27c9395cf4faa9aa1fac6`
`font_03_sfnt_off000174a8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x174A8	21032 bytes
SHA-256: `2633cdb73668b9d1b1507e0dd7592cc9481592bdc88376c049f5a71e0d544a46`

Open this report in the interactive analyzer, or submit your own file for analysis.