PDF malware analysis — malicious · 47e8196e90edae6b

MALICIOUS

PDF

83.8 KB Created: 2021-09-15 10:03:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23

MD5: 4cbec6d4105b236b19f71602d2f36945 SHA-1: a841c2245b749fc00612bad93b7a4fc75d602db5 SHA-256: 47e8196e90edae6b9a0bf999aebf3ae03068961cd05b8854119d23059ea0c6d6

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and a large number of external URIs, many of which are hosted on disposable domains and appear to be part of a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect users to phishing or malware download sites. The embedded JavaScript is a common method for initiating malicious actions within PDFs.

Machine Learning

Nyx PDF Classifier malicious score 0.9977

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.vasutaszeneiskola.hu/ckfinder/userfiles/files/32884278736.pdf In PDF document text
- https://xn--z4qq44i.tw/upload/actfiles/vuwupake.pdfIn PDF document text
- http://rosritual.su/app/webroot/js/ckfinder/userfiles/files/13569628578.pdfIn PDF document text
- http://salon-urody-bellis.pl/images/file/tobet.pdfIn PDF document text
- http://www.virtualaid.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16130decdbb0a7---tatomunu.pdfIn PDF document text
- http://reafamily.lt/ckfinder/userfiles/files/51608108249.pdfIn PDF document text
- http://kavernoklub.com/campannas/file/71105507986.pdfIn PDF document text
- http://www.huntsvillepr.com/files/files/63739909113.pdfIn PDF document text
- https://pikhospital.com/ck_uploads/uploads/files/lolimesuwunizaxiwarom.pdfIn PDF document text
- http://theydeserveastamp.org/wp-content/plugins/formcraft/file-upload/server/content/files/1613e1832afac9---78654963279.pdfIn PDF document text
- http://generaltubi.com/container/ckfiles/files/92627099418.pdfIn PDF document text
- http://kasaitogo.com/uploads/files/23988183847.pdfIn PDF document text
- http://uco-kampen.com/media/files/murukexudeboz.pdfIn PDF document text
- http://geomanteia.com/userfiles/files/padudigemitusuninabajuwe.pdfIn PDF document text
- http://etcpremium.com/userfiles/files/4318173190.pdfIn PDF document text
- http://hermanosgolbano.com/admin/fckeditor/editor/filemanager/connectors/phpfile/kekuwowerugogepevixo.pdfIn PDF document text
- http://xn--80aer5aza.xn--19-kmcm3c.xn--p1ai/ckfinder/userfiles/files/50147488606.pdfIn PDF document text
- https://dancleland.com/img/upload/file/30712561369.pdfIn PDF document text
- https://memorybg.net/app/templates/js/ckfinder/userfiles/files/legetukisuxuze.pdfIn PDF document text
- https://postele-z-masivu.sk/ckfinder/userfiles/files/6282021060.pdfIn PDF document text
- https://quanghuydulich.vn/img_duhoc/files/96239751033.pdfIn PDF document text
- http://boothbayharborshipyard.com/userfiles/file/57978758744.pdfIn PDF document text
- https://accuratesearch.com/userfiles/file/95875337974.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=red+eye+correctionPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e295.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE295	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000faac.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFAAC	10148 bytes
SHA-256: `849461966fe90dc73172ae9c599fd129cd1be9f184dff143427b50dd45d66e87`
`font_02_sfnt_off00011178.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11178	18412 bytes
SHA-256: `1bda2be26efcbcd05c4dc639e1e4cd89567c970e1c083b07d5c6b1bbfb82ae0d`

Open this report in the interactive analyzer, or submit your own file for analysis.