PDF malware analysis — malicious · 49b0236d6f3416ef

MALICIOUS

PDF

80.4 KB Created: 2021-09-12 03:28:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14

MD5: 7f8b6c8f1a8e2929bc0e50c28f6ee298 SHA-1: 49f082e9220ff4a43d88116a71f7f6428be25e04 SHA-256: 49b0236d6f3416ef57abdbd09a255faa171403a3b8ff0cd090de2458d1ad4725

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded JavaScript and a large number of external URIs, many pointing to disposable domains, strongly suggests this document is part of a phishing or malware distribution campaign. The document body is heavily obfuscated and unreadable, providing no direct user-facing content, but the heuristics and URLs point to a malicious redirection scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.5932

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pixomot.ru/uplcv?utm_term=como+baixar+video+do+instagram+para+celular+android PDF link annotation
- https://tolgyesvolgy.hu/userfiles/file/6921767728.pdfIn PDF document text
- http://www.ecostroyservis.ru/File/3164209118.pdfIn PDF document text
- http://olech-rzeszow.pl/userfiles/file/wabenozoxovanaxor.pdfIn PDF document text
- https://kultmotor.hu/images/files/motejerepawibagup.pdfIn PDF document text
- https://atamergranit.com/userfiles/file/wubesawuzotimasimivalij.pdfIn PDF document text
- http://giaphatmed.com/upload/file/nozipure.pdfIn PDF document text
- http://truhlarstvi-strakonice.cz/files/file/nuxamoxafimudusamovinexop.pdfIn PDF document text
- http://mmckno2010.zkosuchdol.info/files/legovubutufufezu.pdfIn PDF document text
- https://natatourism.com/userfiles/files/fevixegelurefilozutopo.pdfIn PDF document text
- http://warwick-ems.org/userfiles/file/babowida.pdfIn PDF document text
- http://studioassociatoemc.com/userfiles/files/vixirile.pdfIn PDF document text
- https://repetitorebi.ge/userfiles/files/perinawimijelejofex.pdfIn PDF document text
- http://rubella2.integra-sh.com/userfiles/file/sulemejagifefofexiru.pdfIn PDF document text
- http://elturo.ru/img/upload/files/44182726174.pdfIn PDF document text
- https://atlaskvartir.ua/data/uploads/files/fenupuduror.pdfIn PDF document text
- http://yomamasushitogo.com/uploads/files/wajupubekofo.pdfIn PDF document text
- https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/1612e9dc6bef9d---85763096763.pdfIn PDF document text
- http://seasonsblinds.com/uploads/ckfinder/userfiles/files/wepekuvapakori.pdfIn PDF document text
- https://solidpractise.com/files/userfiles/file/66166284837.pdfIn PDF document text
- https://www.hotelamoha.it/wp-content/plugins/formcraft/file-upload/server/content/files/16135ca1c34d92---35971760388.pdfIn PDF document text
- http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/1613a1a4232bc5---waxofigu.pdfIn PDF document text
- http://gzbaosui.com/uploadfile/files/wapovixujimikamatip.pdfIn PDF document text
- http://gold-carsales.com/js/upload/files/33113152528.pdfIn PDF document text
- https://quangcaowebsite.vn/uploads/files/redelexozifiladeruna.pdfIn PDF document text
- http://kaizousha.com/js/upload/files/43333408792.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dc72.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC72	19696 bytes
SHA-256: `708928b060b49638821b995ca0a31d2828066980e292314daa8623477e623d32`
`font_01_sfnt_off00010d0f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10D0F	11296 bytes
SHA-256: `6439d39a99938824aecf4912c1a07b7b68c174edcfcc78974e04b6373d7273a0`
`font_02_sfnt_off0001273c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1273C	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.