PDF malware analysis — malicious · 41990ef1b94390ec

MALICIOUS

PDF

86.2 KB Created: 2021-03-29 02:03:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23

MD5: 5d7ecf352b5570adbd8e080301104333 SHA-1: ba122363a1391c0f4e4333149d281a8808396de0 SHA-256: 41990ef1b94390ec731156009dfaed7b5664c240f59480db4a624c11318f6a4a

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URI pointing to 'https://gimoguvi.ru/123?utm_term=beginners+guide+to+meditation+in+pregnancy', which is likely used to redirect the user to a malicious site. The document body, though heavily obfuscated, contains references to the malicious URL and appears to be a lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gimoguvi.ru/123?utm_term=beginners+guide+to+meditation+in+pregnancy PDF link annotation
- https://cdn.sqhk.co/gupikekarobo/hvOjfbm/free_android_music_radio_stations_online_canada.pdfIn PDF document text
- https://cdn.sqhk.co/midipumep/cQhghbM/94279581456.pdfIn PDF document text
- https://cdn.sqhk.co/kogeledewafo/bicii93/nokamipifep.pdfIn PDF document text
- https://cdn.sqhk.co/fakodozug/CgcE75Y/10281012526.pdfIn PDF document text
- https://cdn.sqhk.co/givogaduta/8jijgjg/hack_game_idle_shopping_mall.pdfIn PDF document text
- https://cdn.sqhk.co/biserodafed/jfi4xMT/about_kobe_bryant_crash.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/433a6a48-d5ea-4ccf-b7b2-ce9706a6cd85/wifomujipobezawijewene.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/02739737-b994-4df4-8773-14b656db694f/52450211769.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1a48c7f5-a404-4911-9dfb-f3f9221904df/where_is_the_ir_sensor_on_samsung_smart_tv.pdfIn PDF document text
- https://0ef2f354-78a3-4528-990c-72f69c86fc6a.filesusr.com/ugd/6a0da6_981fca5c8c4641849bc29267285384ea.pdf?index=trueIn PDF document text
- https://07f52280-50dc-49c2-beec-a2e30bf849d0.filesusr.com/ugd/7b8f90_cd9fb6446edb44e59ef20af54c7a7cd5.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/feb3ab6a-8a73-47cf-85d2-4ad7639b1c99/monday_morning_leadership_david_cottrell.pdfIn PDF document text
- https://de7eff9d-5c50-4122-bb99-ee112abf7a8f.filesusr.com/ugd/db8f21_12e50bec23d34f549089763341adb4c3.pdf?index=trueIn PDF document text
- https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_d85a4e73cd2545b6b22eecd52173b0b3.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/5d4fa51d-0fbb-4beb-bda3-c46e489b882d/gluten_free_fast_food_options_2020.pdfIn PDF document text
- https://1628ddcf-e301-416d-9649-d9339b85441b.filesusr.com/ugd/0b1079_4c7703d79c3a4a858459958bd86ae504.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/809f5cfe-1a17-4b52-a095-33cfbdd4adb1/99473825280.pdfIn PDF document text
- https://0b21792c-a699-4cf4-8833-5910c6ad58af.filesusr.com/ugd/b0b521_f87f0d4c396b46d9aef5216ebc26eef7.pdf?index=trueIn PDF document text
- https://01d7ec8a-e38e-4e33-8c76-1be31754498b.filesusr.com/ugd/24d943_01b4958222894c4e8e996675d2fd43b6.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010364.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10364	3476 bytes
SHA-256: `4b41233d3aecc6fa46d5057d7b278473a87c99420a70ec2a7b82f5e94fa992e7`
`font_01_sfnt_off00010fef.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10FEF	5512 bytes
SHA-256: `220a084ef88381017a0598244ec75baf9d381dcf59a92b1ccd3783ae9e43c501`
`font_02_sfnt_off000122a1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x122A1	11296 bytes
SHA-256: `7f2a43dd9bcbcd77c891728bb8cc1c55ec5a6d747cce003fac4c7a417dc04f4c`

Open this report in the interactive analyzer, or submit your own file for analysis.