PDF malware analysis — malicious · 4c7fd5f1ba087900

MALICIOUS

PDF

82.3 KB Created: 2021-03-24 09:35:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13

MD5: 276c5c1092783d701c7371b7f28b996b SHA-1: b380faec017eb39a4939f2ca5fe8c3f9f3c94285 SHA-256: 4c7fd5f1ba087900058bfcb563cf31265f7293f8a459be8f0f68d40788c24567

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external URIs and is flagged by ML and ClamAV as malicious, indicating a phishing or malware distribution attempt. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests a deliberate attempt to obscure malicious links within a large number of seemingly unrelated URLs. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to host links.

Machine Learning

Nyx PDF Classifier malicious score 0.9954

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/award?keyword=bryophytes+lecture+notes+pdf PDF link annotation
- http://mamontov-net.cc/mozasujexegudanaj8m5xa.pdfIn PDF document text
- http://wersita.space/how_to_interpret_c13_nmrpdpnj.pdfIn PDF document text
- http://de-bewertung-889562.icu/levosajefebutitomukiyi6e.pdfIn PDF document text
- http://pixxel.life/193483161935is16.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403557/normal_601b252314953.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481064/normal_6027cdd7161a0.pdfIn PDF document text
- http://about-central.com/48613096249spu1i.pdfIn PDF document text
- http://meetchat.space/who_is_the_best_beatles_tribute_band4dap2.pdfIn PDF document text
- http://xinupavob.iblogger.org/22003000001.pdfIn PDF document text
- http://leree4.club/zovopewiwax4a2aw.pdfIn PDF document text
- http://vabuxobetarewo.22web.org/78345019995.pdfIn PDF document text
- http://businessoutsourcing.info/katimimixiwifulorawazrg0cb.pdfIn PDF document text
- http://zapizimibit.22web.org/advanced_computer_architecture_ebook_free.pdfIn PDF document text
- http://gvidilon.ru/62201953593oz6i2.pdfIn PDF document text
- http://bluebadgeapproval.com/background_remover_pro_apkocz3h.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://kirigawegugava.epizy.com/40656965491.pdfIn PDF document text
- https://s3.amazonaws.com/megodipewukitoj/soal_tkb_pendidikan_agama_islam.pdfIn PDF document text
- http://vibesegajepo.epizy.com/free_online_piano_sheet_music_popular_songs.pdfIn PDF document text
- http://ridikobanugep.rf.gd/xuxuzatamakeperumusalata.pdfIn PDF document text
- http://sidajewaset.epizy.com/naruto_shippuden_opening_16_piano_sheet_music.pdfIn PDF document text
- https://s3.amazonaws.com/mufukep/million_reasons_piano_sheet_free.pdfIn PDF document text
- http://wemixapaw.epizy.com/92830999216.pdfIn PDF document text
- https://s3.amazonaws.com/muvarelo/good_pub_guide_alresford.pdfIn PDF document text
- http://ziwejozaz.epizy.com/api_testing_tutorial_for_beginners.pdfIn PDF document text
- https://s3.amazonaws.com/bifamomove/formal_word_for_love_life.pdfIn PDF document text
- https://s3.amazonaws.com/zarelusipofox/54698649665.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f764.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF764	5016 bytes
SHA-256: `613a14424fefbb1b556f602142138cbcabff3b4e9b87eecee870b7c6a60ce603`
`font_01_sfnt_off0001087b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1087B	10520 bytes
SHA-256: `ebbe9eea8fe0cab94878c2a253d0bd196adb13261f11ae1b57253bc46b881aed`
`font_02_sfnt_off00012c6c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12C6C	4324 bytes
SHA-256: `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`

Open this report in the interactive analyzer, or submit your own file for analysis.