PDF malware analysis — malicious · 38966c0d45e0f321

MALICIOUS

PDF

169.8 KB Created: 2021-03-14 21:18:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22

MD5: e3a408da028940ba4931a349dc5f3caa SHA-1: e39d1a6b4945d434b340b67aa5b55b32d7c15a88 SHA-256: 38966c0d45e0f321241ba783683f06f8a78b80c69f093a960df4f105a1abb99c

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded URLs, many pointing to disposable domains, and is flagged by ClamAV as a phishing trojan. The ML classifier also strongly indicates maliciousness. The document body, though heavily obfuscated, suggests a lure related to educational material, likely to trick users into visiting the malicious URL.

Machine Learning

Nyx PDF Classifier malicious score 0.9984

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://lozipotod.ru/strik?utm_term=libro+de+fisica+3+bachillerato PDF link annotation
- https://static.s123-cdn-static.com/uploads/4416301/normal_5ffe821a3f2bf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402504/normal_6021943ba17d4.pdfIn PDF document text
- https://jexepasevotapak.weebly.com/uploads/1/3/1/6/131606223/giwamub.pdfIn PDF document text
- https://cdn.sqhk.co/votojuxosaf/KifHjhK/my_talking_tom_cat_old_version.pdfIn PDF document text
- https://ramowofotaro.weebly.com/uploads/1/3/1/6/131607053/vepit.pdfIn PDF document text
- https://cdn.sqhk.co/daxerarugak/cihvEiz/wanomafubofubofixuvo.pdfIn PDF document text
- https://cdn.sqhk.co/todusukiraxi/7jabibI/rijodirerisagubiki.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4477873/normal_5ffbb2974742c.pdfIn PDF document text
- https://lipuxavevafip.weebly.com/uploads/1/3/1/3/131398459/9215004.pdfIn PDF document text
- http://theplafond.xyz/zuvereninyhnxz.pdfIn PDF document text
- http://lnstagramcopyrighthelps.com/berazeg2dh6p.pdfIn PDF document text
- https://juruditusevowe.weebly.com/uploads/1/3/5/3/135329261/5330773.pdfIn PDF document text
- http://5gusevshop.space/fit_father_30x3rt67.pdfIn PDF document text
- http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://0cfe495c-9a5f-46a1-a5f3-fb21b6211bac.filesusr.com/ugd/7aabb2_14cf3d40ed7941c8a9ef803081dd726d.pdf?index=trueIn PDF document text
- https://55963656-6eb1-4b25-bcd5-bb835d65808b.filesusr.com/ugd/0064ae_72b63de288be48258d78dacd8fcff03d.pdf?index=trueIn PDF document text
- https://5405d108-7f1e-482b-a10c-e06f62b7505d.filesusr.com/ugd/d941b1_d1ddb630f10842bfaf0b05e92962d830.pdf?index=trueIn PDF document text
- https://2acf176d-1645-44e4-83be-c67f7ac9af6b.filesusr.com/ugd/e72dd6_041474b66698475e9ccb5129028fe5d9.pdf?index=trueIn PDF document text
- https://a179b4bb-f9e1-4b0b-8685-f881d2afde68.filesusr.com/ugd/0fdb6d_4c17d6fd152d45b194c984339d1a965c.pdf?index=trueIn PDF document text
- https://eee5dff6-7331-416e-acdf-593d0c386862.filesusr.com/ugd/21e9e0_a43511b213ed4938a13414ede1e6fe63.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00023205.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x23205	1804 bytes
SHA-256: `d9f5017369bbb3bca907000730d9c30453fe6ea8c1c03506960697e75d474249`
`font_01_sfnt_off00023af7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x23AF7	5356 bytes
SHA-256: `47b740cccae8c0266dd394312dc67a19dd2ec054a5e83b88fcea0bd3a96ebce5`
`font_02_sfnt_off00024d27.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x24D27	15276 bytes
SHA-256: `9f35f01ff6353e0df79568fe94c365db1a1f4950b574ccae48940027b6c3026b`
`font_03_sfnt_off00027e81.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x27E81	16856 bytes
SHA-256: `686d88a467c5ef38542edc071d4e7c7e5888e0547d2d93cb3c2c11e7f23e6f25`

Open this report in the interactive analyzer, or submit your own file for analysis.