PDF malware analysis — malicious · 2431a50efc18bf90

MALICIOUS

PDF

79.0 KB Created: 2021-09-20 20:33:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23

MD5: 4f6897152f07c205c3953f5ca3144f55 SHA-1: 71c42b378ba5cafcbe0b37dbc41932ccd951fe00 SHA-256: 2431a50efc18bf9079978541598b556c6417e59f34c6755f09a81942e21fcf1b

166 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous links to external resources, many of which are hosted on disposable domains and appear to be part of a link farm. The heuristic 'PDF_RANDOM_URL_LINK' and 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggest a malicious intent, likely for phishing or distributing further malware. The ClamAV detection and ML classifier further support the malicious classification.

Machine Learning

Nyx PDF Classifier malicious score 0.9975

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK

PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://medvor.ru/uplcv?utm_term=dzongkha+grammar+book+pdf PDF link annotation
- http://aceonlinementors.com/userfiles/file/73184941311.pdfIn PDF document text
- http://tatishev.ru/admin/ckfinder/userfiles/files/12385623285.pdfIn PDF document text
- http://mirsistem.com/depo/sayfaresim/file/60078178011.pdfIn PDF document text
- http://infypos.com/infyposcms/media/lexuju.pdfIn PDF document text
- http://internet-trade.cz/UserFiles/file/87867898224.pdfIn PDF document text
- http://curvesncontours.com/userfiles/file/95701068534.pdfIn PDF document text
- http://wamer.org/userfiles/file/607526936.pdfIn PDF document text
- https://rosettes.it/userfiles/file/panuval.pdfIn PDF document text
- http://mueblesdepladur.es/1/userfiles/file/20496868828.pdfIn PDF document text
- http://ave-france.com/pics/files/15374383382.pdfIn PDF document text
- http://1night2daytour.com/ckupload/files/20992179927.pdfIn PDF document text
- http://lrm.mcdonalds.ua/ckfinder/userfiles/files/44850425106.pdfIn PDF document text
- http://ambulatorioveterinariosantanna.eu/userfiles/files/piburixikonopap.pdfIn PDF document text
- http://ufnk.fr/app/webroot/files/file/8666744707.pdfIn PDF document text
- http://podolsk-kondicionery.ru/upload_picture/file/70702964281.pdfIn PDF document text
- https://bushregenerators.net/userfiles/files/40962172435.pdfIn PDF document text
- http://turhantur.com/turhantur/files/32337422280.pdfIn PDF document text
- http://songhakbbq.com/uploads/files/17376034323.pdfIn PDF document text
- https://musikkursus.dk/userfiles/file/44594100341.pdfIn PDF document text
- http://langfordfinancialservices.com/userfiles/files/3752981817.pdfIn PDF document text
- https://binhvi.com/upload/files/defafizafinapetuki.pdfIn PDF document text
- http://hengtaixin.com/HangShun/ckfinder/userfiles/files/96946821476.pdfIn PDF document text
- http://americansemitruckparts.com/d/files/tesufilekosumivupeluka.pdfIn PDF document text
- http://lpc2529.com/piceditor/file/bekam.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d057.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD057	10704 bytes
SHA-256: `2a4a3555adff0a1202b48ce316b231771a10c0058ca91c6a9637b8de43ea6afe`
`font_01_sfnt_off0000e83e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE83E	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00010050.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10050	17492 bytes
SHA-256: `6927aa3127e91e5cd17997cfa6ae9edcf041ddfa4e1522e6d4737aa7354e7ab4`

Open this report in the interactive analyzer, or submit your own file for analysis.