PDF malware analysis — malicious · 3cf2c1a4f462598f

MALICIOUS

PDF

86.3 KB Created: 2021-03-31 16:22:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23

MD5: d5878b65907a0c697185a8aeb9a1a8a1 SHA-1: 8c143891efa34027642599e2fbf006d11c62cace SHA-256: 3cf2c1a4f462598fd8a973c4490ec65061f5a2831ccf723f3ae1a79e563ec448

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. The presence of numerous embedded URLs, many pointing to disposable hosting, suggests a link farm designed to redirect users to potentially harmful sites. The document body, though heavily obfuscated, contains keywords related to device rooting, which could be part of a phishing lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/wix?keyword=galaxy+s4+root+xda PDF link annotation
- http://jofifuneku.medianewsonline.com/tropisms_nathalie_sarraute.pdfIn PDF document text
- http://sufofure.mywebcommunity.org/ruzibegotakiwemifupukifa.pdfIn PDF document text
- http://fefiwizam.sportsontheweb.net/rapid_spanning_tree_protocol.pdfIn PDF document text
- http://zikewexer.scienceontheweb.net/burdens_are_lifted_at_calvary_lyrics.pdfIn PDF document text
- http://delozofize.scienceontheweb.net/alcalosis_respiratoria_tratamiento.pdfIn PDF document text
- http://bodaweziwov.mypressonline.com/grade_8_math_worksheets.pdfIn PDF document text
- http://sobuvide.mygamesonline.org/que_es_el_marketing_de_contenidos.pdfIn PDF document text
- http://nuloriwilorij.scienceontheweb.net/definisi_pendidikan_agama_islam.pdfIn PDF document text
- http://xeberul.mywebcommunity.org/becoming_a_better_man.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/2a863110-ff55-4721-9a68-d471def0d286/64631475387.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d53ff29-7f95-432a-9bf7-eaa60b4281cf/robaxanokixafidejo.pdfIn PDF document text
- http://bipegokatif.onlinewebshop.net/accidentes_de_trabajo_mexico.pdfIn PDF document text
- https://s3.amazonaws.com/pevarijidasalop/pirate_hat_template_free_printable.pdfIn PDF document text
- https://s3.amazonaws.com/palevijuj/who_wrote_the_poem_on_the_road_to_mandalay.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b14c537-5995-462c-b161-cc1b7e42c876/timex_expedition_wr100m_watch.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af8cd654-a959-4745-ba05-9a2273686ab7/kaxok.pdfIn PDF document text
- http://giworutiw.myartsonline.com/lolafawuzakaxepi.pdfIn PDF document text
- http://perexuwofogefo.onlinewebshop.net/zesozabonebimibe.pdfIn PDF document text
- https://s3.amazonaws.com/fuwuzerijofa/reported_speech_questions_exercises.pdfIn PDF document text
- https://s3.amazonaws.com/lokijuronig/21830953879.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c9808091-9a83-456a-956e-172b49c7dc1f/how_to_sequence_a_beginners_yoga_class.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3e6b5f40-5365-4cea-96a1-0cf9d69e86c6/doxaselavegipemu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f413.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF413	5108 bytes
SHA-256: `6f81d55f61c21aa3e581276addfd5c8feaaf51fa5f0367ca6f84a250caec5391`
`font_01_sfnt_off00010596.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10596	19972 bytes
SHA-256: `da4433d6642888237c876db0e61301cb110c41c8044133f01d3ab4bb95544156`
`font_02_sfnt_off0001361e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1361E	16392 bytes
SHA-256: `8d9529fca8e49fd747a132c86257b3f003f6793d9f50918e3e02e184cbe99d44`

Open this report in the interactive analyzer, or submit your own file for analysis.