PDF malware analysis — malicious · 4457f6c2bcacb945

MALICIOUS

PDF

80.6 KB Created: 2021-03-22 13:27:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21

MD5: eebc3c6058b6921ba74d4f4d25035d1c SHA-1: 757ff63a9fab5416867348514a15bf59a9da6032 SHA-256: 4457f6c2bcacb945fe38d47e89d862d7a35a38c971b29e939da8438f7f49f722

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple heuristics indicating it is a link farm designed to redirect users to malicious sites, as evidenced by the 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_URI' firings. The ML classifier and ClamAV detection strongly suggest malicious intent, likely for phishing or malware delivery. The embedded URL 'https://midufefew.ru/strik?utm_term=for+my+legionaries+review' is the primary indicator of the attack's destination.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://midufefew.ru/strik?utm_term=for+my+legionaries+review PDF link annotation
- http://snatural.space/brawl_stars_opening_mega_boxbm7uj.pdfIn PDF document text
- http://foodguideblog.com/dabutugeretafavuef4dl.pdfIn PDF document text
- http://itawegan.fun/cadillacs_and_dinosaurs_apk_fileyenc2.pdfIn PDF document text
- http://axecheat7.xyz/21323542137md7pr.pdfIn PDF document text
- http://thecaffeinatedstudent.com/long_haired_dapple_dachshund_puppies_floridatfmnz.pdfIn PDF document text
- http://sallles.ru/51904482598dprnh.pdfIn PDF document text
- http://kino-vezde.ru/cms_h.264_dvr_client_software_downloadwqial.pdfIn PDF document text
- http://verifybadgesbusiness.com/reaccin_de_combustion_completa_del_propanob113u.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://f64a1a0a-debf-4843-a838-a34c0cae0f4a.filesusr.com/ugd/89602e_07314f9b5a2d4002926d494379000a55.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vebisop/python_learning_2018.pdfIn PDF document text
- https://711920be-b761-4f0e-a604-762b26663b16.filesusr.com/ugd/ffcbea_1c0630eba89a47efbb6f1d141ea46952.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nefunupu/bread_machine_recipes.pdfIn PDF document text
- https://52468903-0e2d-47c5-babb-61e1d305d291.filesusr.com/ugd/32777b_6027bb7657d846989c00c612e5fe070c.pdf?index=trueIn PDF document text
- https://6525eaf8-9a42-4119-9fb4-c3d475b3b78e.filesusr.com/ugd/80bfa9_25cc43f858a44af9ba720eeaf4cbb5b4.pdf?index=trueIn PDF document text
- https://05efeaee-ea5b-4dc8-bddc-a5098cc0dcbd.filesusr.com/ugd/c06c30_0cba9c2764dd47a29768bd49d0a2ab27.pdf?index=trueIn PDF document text
- https://56db2a4d-09ce-4ff6-a558-abb1d6727cd4.filesusr.com/ugd/003b86_d7a34f875ef94156b02e906734518bec.pdf?index=trueIn PDF document text
- https://de2a8dfc-dc8d-4d62-be3b-f97abdd17bf6.filesusr.com/ugd/c722c2_85854e0376eb491bbbdb88b9c3e2ba13.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jefazaxal/agatha_christie_s_poirot_episode_guide.pdfIn PDF document text
- https://s3.amazonaws.com/jusagi/xetavojaxekufurefabezudu.pdfIn PDF document text
- https://bdee3e82-1fe6-4084-b289-f15f5249f83e.filesusr.com/ugd/749937_c3fd6a720f5543c1a3ef89190af96dfe.pdf?index=trueIn PDF document text
- https://49b7c339-fea6-4bb3-bf7b-ca47af5263df.filesusr.com/ugd/6ca12d_74db419b22a144fca8a93157707a7824.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000effe.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEFFE	4924 bytes
SHA-256: `8bbc5a8f0f2699c055fcaeb36d25dab5f048f8a86ccd726ae117eac38f7274de`
`font_01_sfnt_off000100ae.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x100AE	11688 bytes
SHA-256: `664590bef262b00e600a57d2fbad9e2f3dc0d1d566e4175f55dad3c6227acddf`
`font_02_sfnt_off000126c8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x126C8	4324 bytes
SHA-256: `b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c`

Open this report in the interactive analyzer, or submit your own file for analysis.