PDF malware analysis — malicious · 3d7e755e1605ff19

MALICIOUS

PDF

80.7 KB Created: 2021-04-30 23:42:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13

MD5: ee5fd677f9f7826a23071be1bb431917 SHA-1: bd1f9af63d93215bed713ecbb540cfc3573aeeb3 SHA-256: 3d7e755e1605ff19c1c24b6e7e12b19e46ec2dd2bb176f6f4a44f942c2609662

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing document and a link farm on disposable hosting. The embedded URL points to a suspicious domain, likely intended to redirect the user to a malicious site. The ML classifier and ClamAV detection strongly suggest malicious intent, consistent with a phishing lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/strik?utm_term=how+to+restart+a+electric+water+heater PDF link annotation
- http://igme.site/xeraretisarobi0821.pdfIn PDF document text
- http://teenagetutor.net/fitaminotanemexugavebojodtab4k.pdfIn PDF document text
- http://sikazigazes.mypressonline.com/how_to_recline_evenflo_triumph_lx_convertible_car_seat.pdfIn PDF document text
- http://nositadox.mypressonline.com/zojilu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489975/normal_60640ee22f4d0.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4413346/normal_600748a8e8e3a.pdfIn PDF document text
- http://remont-pc.website/466076042t4odw.pdfIn PDF document text
- http://free-at.pro/what_is_bluehost_wordpress_hosting7l9zt.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426830/normal_600a146531c9b.pdfIn PDF document text
- http://strgb2.ru/amended_tax_return_2016_formia1o8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4465557/normal_6052c61512ba9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385887/normal_602ed2216a009.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462992/normal_60312f50d4864.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://a22c3535-4c29-4f26-bf6b-1e631d3648e5.filesusr.com/ugd/28986c_79df8dd4100443be9c27fa49fd14060c.pdf?index=trueIn PDF document text
- https://e590c0d9-b694-44fb-9862-47327b30d8b0.filesusr.com/ugd/89363e_c4e0945bec0c49b3b900132ad5ea2e03.pdf?index=trueIn PDF document text
- http://rosajeku.myartsonline.com/yo_yo_ma_fort_worth.pdfIn PDF document text
- https://0fc0baf9-b884-4fcd-968e-f93c0f938930.filesusr.com/ugd/68ec51_99765a8e1cec4ead8547312457b088ca.pdf?index=trueIn PDF document text
- https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_9825b65ed7b742fd90a34ef1980929a9.pdf?index=trueIn PDF document text
- http://betakudo.atwebpages.com/how_can_you_tell_if_the_inducer_motor_is_bad.pdfIn PDF document text
- https://438e95ed-c264-4db5-88d3-1a9ca8b91b86.filesusr.com/ugd/733c1f_4cc6493d330544c8a690125521193d63.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lezopobigeza/texans_ravens_injury_report.pdfIn PDF document text
- https://s3.amazonaws.com/sazixipame/kogebogazuge.pdfIn PDF document text
- http://romapubimowa.onlinewebshop.net/vufajoxegegam.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f161.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF161	4624 bytes
SHA-256: `6d9d831a6c4210dc92d8f9e038063835601d043e022e6ac60d123d58319ee12f`
`font_01_sfnt_off00010131.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10131	10648 bytes
SHA-256: `6c3f1fdb7909464dd73341d9a8d583bfe3226615a10c3e14fb4d8a326212a804`
`font_02_sfnt_off00012590.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12590	4324 bytes
SHA-256: `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`

Open this report in the interactive analyzer, or submit your own file for analysis.