PDF malware analysis — malicious · 3d4d4ad3c52c77eb

MALICIOUS

PDF

83.5 KB Created: 2021-09-17 13:07:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-20

MD5: b7b4c2f754d7a1e5b82436f74c87801e SHA-1: 2fa92b7aa592344ac697b00885a4a88a2a66abc7 SHA-256: 3d4d4ad3c52c77ebb3e43f2aeba64fb0d4674e2586d3c437b1ca6fbdf1838eb2

146 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including ML classifiers and ClamAV, indicating malicious content. The presence of numerous external URIs and the 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristic suggest a link farm designed to redirect users to potentially malicious sites. While no scripts were explicitly extracted, the 'SE_QR_LURE' heuristic indicates the document may instruct users to scan a QR code, a common tactic in phishing campaigns.

Machine Learning

Nyx PDF Classifier malicious score 0.9974

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
QR-code redirect lure medium SE_QR_LURE

Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crewmak.ru/uplcv?utm_term=js+qr+code+reader PDF link annotation
- https://yar-net.ru/userfiles/file/pifimibulowomurigi.pdfIn PDF document text
- http://langeline.com/ckeditor/upload/files/vezudibipazena.pdfIn PDF document text
- http://p-energo.ru/content/file/37740242522.pdfIn PDF document text
- http://myrbacken.se/login/ckfinder/userfiles/files/3760601908.pdfIn PDF document text
- http://chothuethietbi.info/img/files/21258468630.pdfIn PDF document text
- https://stratasphere.online/userfiles/file/87348185985.pdfIn PDF document text
- https://euronuts2009.ge/files/files/tosinopulem.pdfIn PDF document text
- http://bige.vn/uploads/userfiles/file/lerivitasorabug.pdfIn PDF document text
- https://marathonblainville.com/userfiles/files/25061244618.pdfIn PDF document text
- https://bitree.com/ckfinder/userfiles/files/sozulisesasuve.pdfIn PDF document text
- http://hangtatmj.com/userfiles/zawekugonopagurovokukew.pdfIn PDF document text
- http://deleersnijder-bocaege.be/images/file/37242947100.pdfIn PDF document text
- http://whipitleather.com/userfiles/file/nawukevewotodanuvawa.pdfIn PDF document text
- https://keyword-lda.pt/site/upload/file/50707784351.pdfIn PDF document text
- http://eventechsite.com/files/files/43153530008.pdfIn PDF document text
- https://www.aledrukujemy.pl/ckfinder/userfiles/files/86392728105.pdfIn PDF document text
- http://iamsoldierfit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613d01366a6d1---wukupaponazasa.pdfIn PDF document text
- http://pyhunlian.com/uploadfile/file/87160285908.pdfIn PDF document text
- http://rem-proekt.com/f/file/xizuxasaxudije.pdfIn PDF document text
- http://easytravel63.ru/ckfinder/userfiles/files/8783033731.pdfIn PDF document text
- https://narellesastro.com/userfiles/files/laforunadexafamareluro.pdfIn PDF document text
- http://shyjjc.com/v15/Upload/file/20219171336182899.pdfIn PDF document text
- http://tpfish.com.taipei/archive/upload/files/lomexurasofobazevukix.pdfIn PDF document text
- http://xn--82cac8d3ajrc0gd0bo4a7nf3qg.com/userfiles/files/46908359837.pdfIn PDF document text
- http://allasclub.com/campannas/file/nubokelud.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e3a7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE3A7	17744 bytes
SHA-256: `fb1e82022383b0ac878644462ca9ad1fafc005823769124a24b8f6760f100af9`
`font_01_sfnt_off000111f5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x111F5	10160 bytes
SHA-256: `a9e33973853caa6fd3c56bd3817b0cb3bb998cf1f39f9bfb800bcd2979e67d37`
`font_02_sfnt_off0001288f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1288F	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.