PDF malware analysis — malicious · 4b9e1b740a88e983

MALICIOUS

PDF

82.0 KB Created: 2021-04-21 16:20:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20

MD5: 13774faf76a4b0ae465e434a1c83db0d SHA-1: da305274cea6e19406f124db98d2b1d353bfdd44 SHA-256: 4b9e1b740a88e98327025942312cb0ed26f411d16e83a527bd26e62a543a953d

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. It contains numerous embedded URLs, with one prominent URL, 'https://xajibur.ru/strik?utm_term=what+does+a+pre+lab+consist+of', appearing to be a phishing lure disguised as a search result. The document body, though heavily obfuscated, suggests it is part of a link farm designed to redirect users to malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xajibur.ru/strik?utm_term=what+does+a+pre+lab+consist+of PDF link annotation
- http://zoxatib.iblogger.org/mogazotopudejax.pdfIn PDF document text
- http://afracheat8.xyz/kidadexogexegesagunetek5fvg.pdfIn PDF document text
- https://cdn.sqhk.co/minamojazi/tghWjhI/the_forest_crafting_guide_download.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4410695/normal_602d36926aa05.pdfIn PDF document text
- https://cdn.sqhk.co/vekuperik/ihnidhj/caricature_program_free.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4476952/normal_5ffb5ce94b5e5.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4366958/normal_5fe381abafa4e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372383/normal_60169239f18c2.pdfIn PDF document text
- http://matcobzor.ru/how_long_to_download_gta_5_on_xbox_onew6rbb.pdfIn PDF document text
- http://vejofewi.iblogger.org/different_branches_of_physics.pdfIn PDF document text
- https://cdn.sqhk.co/kekotenonaxu/1iiKicc/5936966363.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4423780/normal_6016fb1a4832b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/tizowodifi/xopoj.pdfIn PDF document text
- https://983c8978-ad56-435f-a988-47358aa6040c.filesusr.com/ugd/06a663_480949bbed6c407180789ea8815e6827.pdf?index=trueIn PDF document text
- https://4253c66a-660d-4c83-b31d-f715833d547b.filesusr.com/ugd/d9e9a0_f72c59c2d8d842a3aeccdde06e393161.pdf?index=trueIn PDF document text
- http://gojejamajutemus.epizy.com/artillery_report_command.pdfIn PDF document text
- https://s3.amazonaws.com/zewimu/american_society_for_parenteral_and_enteral_nutrition_2019.pdfIn PDF document text
- https://ac3db616-04cb-40f1-8357-c67041f5e20c.filesusr.com/ugd/eda9ba_db953501d41b461798682ef553fb8867.pdf?index=trueIn PDF document text
- http://tizelimanux.rf.gd/porafunag.pdfIn PDF document text
- https://s3.amazonaws.com/mukut/23592745555.pdfIn PDF document text
- https://s3.amazonaws.com/pomaxa/28451886715.pdfIn PDF document text
- https://7e62deb9-9b1a-4e2d-8b60-9a8f762ee201.filesusr.com/ugd/1f553f_b0f0bea3eec348e29978517c57b4f9ad.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f2e8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF2E8	5184 bytes
SHA-256: `bfde1f8f173bf173671ee7da88a05339aeb8e96b0117673a3640df673fe4e026`
`font_01_sfnt_off00010485.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10485	11808 bytes
SHA-256: `09d8547b17d660c72c8477af24f2cf8e2b5f14670cb9bcdf70d5830ff949e7c2`
`font_02_sfnt_off00012ca2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12CA2	4324 bytes
SHA-256: `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`

Open this report in the interactive analyzer, or submit your own file for analysis.