PDF malware analysis — malicious · 34b34b38b9e643d4

MALICIOUS

PDF

80.3 KB Created: 2021-03-30 01:53:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13

MD5: f421fc56028b3d0db0fb95a2739bee4b SHA-1: 583e7889d72a7ce8af00fc14fb87cc125a8702c2 SHA-256: 34b34b38b9e643d4cb31ca11193c4f7686638e3f5bd347d8c67703040d9d63bf

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple external URIs, with a notable heuristic identifying it as a link farm on disposable hosting. The primary malicious URL, https://nipisod.ru/strik, is associated with a search term for printer ink, suggesting a lure for potential buyers. While no scripts were directly extracted, the PDF structure and heuristic firings strongly indicate a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/strik?utm_term=canon+pixma+mp160+ink+walmart PDF link annotation
- https://cdn.sqhk.co/xolafunodo/hiaR3hh/bed_furniture_design.pdfIn PDF document text
- https://cdn.sqhk.co/nabotogemobe/WhjskjN/yummy_sugar_cubes.pdfIn PDF document text
- http://kevefuwot.iblogger.org/negow.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4463308/normal_5ff781beeb4c1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4483623/normal_603ccbe7789a7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4471082/normal_5fc5d837918f8.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4373985/normal_5ff06d9a6caea.pdfIn PDF document text
- https://cdn.sqhk.co/xufaribo/hhjeRI3/lasuxoxakatu.pdfIn PDF document text
- https://cdn.sqhk.co/nanagajog/iVhhigd/45487972490.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/nijudow/delaware_annual_report_late_fee.pdfIn PDF document text
- https://s3.amazonaws.com/xiwevitox/kung_fu_panda_2.pdfIn PDF document text
- http://doboroguvenuv.epizy.com/31033371025.pdfIn PDF document text
- http://bajivuselome.epizy.com/why_my_subwoofer_is_not_working.pdfIn PDF document text
- http://dikewovob.epizy.com/roxazesitaparapuw.pdfIn PDF document text
- https://s3.amazonaws.com/sulasatevirexo/famuvelaxa.pdfIn PDF document text
- http://gidepajujida.rf.gd/ps_gold_headset_charge_time.pdfIn PDF document text
- https://2aa0b900-127f-4603-a19a-6a731d3c9eb1.filesusr.com/ugd/5eaffa_3f32b71554d040a089e2abe895c0206a.pdf?index=trueIn PDF document text
- https://f579be4a-c2ec-451d-94ee-532237c06880.filesusr.com/ugd/9f6a24_73fe095a9b5c44b9aa5d9aa7c6524699.pdf?index=trueIn PDF document text
- https://48936d5e-4b15-4059-a328-ddb12afcc15e.filesusr.com/ugd/173145_dcd3906810754ebda310df32f49634e1.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/ganubifirigevi/85143969364.pdfIn PDF document text
- https://47ab6ce1-aee6-4086-a8e7-31fe393d2411.filesusr.com/ugd/afbef4_a96f4a42aa724780b9255e84b071fef2.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wurivuve/31729600780.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3e5f539c-7750-4b12-b19f-db3f08eae44d/wowizefofir.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/daa0db2c-bcd9-4f7a-a346-32f78d670996/pexodid.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e6c2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE6C2	5264 bytes
SHA-256: `d7ddfcb31d38e7727efa37284ad6538500e8963765aa8d9188564a3798163479`
`font_01_sfnt_off0000f8ab.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF8AB	11024 bytes
SHA-256: `4e314e4e18c7a9834b49e6943002b3fe4d7e676617b0b2af74cf5dd973dcc334`
`font_02_sfnt_off00011e43.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11E43	16204 bytes
SHA-256: `a109d5cc1a8599929bd7702a943337bd153faf2776ff4e30ac39a15e38c17cef`

Open this report in the interactive analyzer, or submit your own file for analysis.