PDF malware analysis — malicious · 36b3d9b271a0e143

MALICIOUS

PDF

71.5 KB Created: 2021-10-06 10:25:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25

MD5: 35418e3acd63497168332d219804b8b4 SHA-1: 544f089d1ff359e0241fe0edcfe21e83695a46f2 SHA-256: 36b3d9b271a0e143fa529d5f869943d73674bbcd3d3d55561aa6e57aedd830ba

166 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous external links, with heuristics identifying it as a link farm on disposable hosting and containing algorithmically-generated URLs. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or distributing further malware. No scripts were extracted, but the structure suggests a lure to external, potentially malicious, content.

Machine Learning

Nyx PDF Classifier malicious score 0.9951

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK

PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://allytemp.ru/uplcv?utm_term=mitochondria+responsible+for PDF link annotation
- https://pustelnik-budownictwo.pl/ckfinder/userfiles/files/gorukixizusidaruzote.pdfIn PDF document text
- https://galerieportelouise.be/userfiles/files/84126509577.pdfIn PDF document text
- http://turatabor.hu/media/dutozezokotu.pdfIn PDF document text
- http://incomingmakedonia.com/files/files/23036033049.pdfIn PDF document text
- http://www.rpv-drachten.nl/files/file/3649831203.pdfIn PDF document text
- http://werder-ritter.de/UserFiles/File/xugobusi.pdfIn PDF document text
- http://fincasotilloviejo.es/files/sotillo/_repo/file/buwomexulelixi.pdfIn PDF document text
- http://www.yevres.fr/ckfinder/userfiles/files/kuvomevelelanuf.pdfIn PDF document text
- https://pachetedeturism.ro/images/files/53773652580.pdfIn PDF document text
- http://associatedreclaimed.com/userfiles/files/petudaxivamavu.pdfIn PDF document text
- http://braghieriarchitettura.com/userfiles/files/51133678597.pdfIn PDF document text
- http://chronocertif.com/userfiles/file/nokuseno.pdfIn PDF document text
- http://clearlakesd.org/wp-content/plugins/formcraft/file-upload/server/content/files/1613cb8b1c734f---fitajof.pdfIn PDF document text
- http://trip-sale.ru/userfiles/file/27988508538.pdfIn PDF document text
- http://lexuspolymers.com/assets/ckfinder/userfiles/files/dekefaxipiwon.pdfIn PDF document text
- http://ambulatorioveterinarioscapindandrea.it/userfiles/files/gumoxalozagopunozupu.pdfIn PDF document text
- http://clickvay.com/upload/files/didit.pdfIn PDF document text
- http://www.valaisconsulting.ch/file/93706449570.pdfIn PDF document text
- http://www.premiumimport.nl/ckfinder/userfiles/files/luvibegibugi.pdfIn PDF document text
- http://afslab.asia/upload/files/59131253383.pdfIn PDF document text
- http://e-menu.hu/editor_up/xedimipifi.pdfIn PDF document text
- https://gancza-yacht.pl/userfiles/file/sasimixixarelojawaxomip.pdfIn PDF document text
- http://sanarina.de/ckfinder/userfiles/files/29967232099.pdfIn PDF document text
- https://samsunyapi.com/userfiles/files/95896602688.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b582.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB582	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000cd94.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCD94	16460 bytes
SHA-256: `41853f72e41f178e2a51f36bb73aef7a9dd988107a3e26caf410a5205eedd0b5`
`font_02_sfnt_off0000f7e4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF7E4	10852 bytes
SHA-256: `0deb6644364aa70ac3b0427c8023435ea23903086aa6d569ca901f9f816654fa`

Open this report in the interactive analyzer, or submit your own file for analysis.