PDF malware analysis — malicious · 547b0986fde22208

MALICIOUS

PDF

86.5 KB Created: 2021-05-12 13:15:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23

MD5: 5f74fe950917507e3a7b0ad77f4460f4 SHA-1: 214a7c09555ee384df28f9e2974d1dd60bf9a335 SHA-256: 547b0986fde222086a1b4fb9a36851145f91bbb8c165560dfb5e85b240e03510

214 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with a critical heuristic firing for a malicious redirector. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically. The presence of a malicious redirector URL and the PDF_SEO_LINK_FARM heuristic indicate an attempt to direct users to potentially harmful sites, possibly for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/strik?utm_term=marvel+schebler+tsx+carburetor+manual In PDF document text
- http://wisecreditscore.info/fifty_shades_of_grey_summary_by_chapter7keqx.pdfIn PDF document text
- http://znohist.site/71418027700njrr0.pdfIn PDF document text
- http://nadipewin.mywebcommunity.org/durga_saptashati_book_download_telugu.pdfIn PDF document text
- http://odebayitrafikhizmeti.com/graphing_linear_equations_worksheet_grade_9t01pg.pdfIn PDF document text
- http://my-favshoph.online/the_norton_anthology_of_african_american_literature_third_editionoj6l2.pdfIn PDF document text
- http://artistichomesolutions.com/hair_colour_tube_storage_rack_ukh3x7q.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/b1fd8952-b0ce-4f1e-bca7-222b24558b38/dream_deferred_poem_by_langston_hughes_analysis.pdfIn PDF document text
- https://7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com/ugd/8127dd_9512da0d40594d51add1f64077b39cb1.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/c767630c-d9ec-4c17-a8d1-1e14d1e5273a/krups_waffle_maker_manual_654.pdfIn PDF document text
- https://s3.amazonaws.com/fezenur/canada_election_platforms_ndp.pdfIn PDF document text
- https://s3.amazonaws.com/rowubunak/acura_integra_2001_manual.pdfIn PDF document text
- http://wazeniwemir.onlinewebshop.net/zumometekapupepapom.pdfIn PDF document text
- https://s3.amazonaws.com/fukezavazuj/92287260651.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c53144a8-61e9-47b8-a8e7-08b70a5bae62/23758411436.pdfIn PDF document text
- https://s3.amazonaws.com/midizaxopazeji/48414613923.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/74f5cca8-09cd-433c-b754-f41645a6fa6d/49466401139.pdfIn PDF document text
- https://73af689e-4c80-4f62-99d3-7a886641ad81.filesusr.com/ugd/3b5dd9_bcfccab03c3e4a09a1d10d6cd2b861bc.pdf?index=trueIn PDF document text
- http://saboveliga.myartsonline.com/tiduriberasoliwuw.pdfIn PDF document text
- https://3228dc58-b2c1-4aed-ac20-03fc52793822.filesusr.com/ugd/43afbb_4142d58601f340a1bd2e88a40cb41577.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xovekolamoxe/how_to_find_a_picture_of_my_id.pdfIn PDF document text
- https://s3.amazonaws.com/fasudikek/18734655949.pdfIn PDF document text
- https://s3.amazonaws.com/pibajuwi/15187406528.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000105ad.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x105AD	5148 bytes
SHA-256: `5583dd390068884805da6b0bc1a1abbec0720fa108bc0d16978dd6b7ba347716`
`font_01_sfnt_off00011710.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11710	11448 bytes
SHA-256: `08d1d7aac485f5410eb25d3e6c668b77dd39fd25deade9eeb8c3f9fd18a11638`
`font_02_sfnt_off00013e45.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13E45	4324 bytes
SHA-256: `a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f`

Open this report in the interactive analyzer, or submit your own file for analysis.