PDF malware analysis — malicious · 56c0c1a70db69ce0

MALICIOUS

PDF

73.6 KB Created: 2021-06-06 02:07:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 248532e4e8a3586cb7a59afcce55b51c SHA-1: 12acdf353f4f5bfda31ff58f256c23544cd14531 SHA-256: 56c0c1a70db69ce0868bac7483a9b8d52d69b5c1b8ffea3ca65bf4b7ec09cbf2

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document contains an embedded URI pointing to 'maypoin.ru', which is likely a phishing or malware distribution site. The presence of multiple embedded links and the use of a disposable hosting service for other PDFs suggest a link farm or spamming operation.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://maypoin.ru/123?utm_term=bts+love+yourself+answer+album+unboxing PDF link annotation
- https://static.s123-cdn-static.com/uploads/4426425/normal_5fd02c2eb7459.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384461/normal_600b0949ae375.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4499651/normal_5fc650fbd1f6d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4445116/normal_5fe5535a1f7e7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481994/normal_606bdf6aa3035.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://watusuxipidu.pbworks.com/w/file/fetch/144560262/39914155841.pdfIn PDF document text
- http://vulazojab.pbworks.com/w/file/fetch/144544929/free_medical_biochemistry_books.pdfIn PDF document text
- http://tedadopite.pbworks.com/w/file/fetch/144688119/34476740101.pdfIn PDF document text
- http://bopezijitex.pbworks.com/f/pelicula_el_rey_leon_1_completa_en_espaol_latino_2019.pdfIn PDF document text
- http://jiboduxoguv.pbworks.com/w/file/fetch/144668079/18837763981.pdfIn PDF document text
- http://jaxonewu.pbworks.com/f/7306944473.pdfIn PDF document text
- http://panuduxeruv.pbworks.com/w/file/fetch/144585303/flight_simulator_games_mod_apk.pdfIn PDF document text
- http://mapaduzipi.pbworks.com/w/file/fetch/144525879/xenegedigibajobepe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ce9e8a33-354f-47ce-b628-3893f8342e53/what_is_a_conceit_a_word_that_appeals_to_the_five_senses.pdfIn PDF document text
- http://felefejimax.pbworks.com/w/file/fetch/144581580/the_hunger_games_chapter_11_short_summary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/87fa76a7-0ee3-49b6-863e-cfb2d1d0697e/94417055308.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ff6f9da2-8c1a-4714-90a6-2cd4cf28ac38/wojakis.pdfIn PDF document text
- http://letonepamusi.pbworks.com/f/minevipepavidadenefevovil.pdfIn PDF document text
- http://fixulirulafa.pbworks.com/w/file/fetch/144526674/94118989253.pdfIn PDF document text
- http://kuxuraroj.pbworks.com/w/file/fetch/144677118/matelesazabapuze.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2c70dea8-66ad-458d-a443-6dd7cf43f387/taluxupomarogegimeloza.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d16c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD16C	4076 bytes
SHA-256: `5fb1ec26d301228ace59a60214e28a3ec6dbe1f325649a42b39ec913338dde92`
`font_01_sfnt_off0000dffe.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDFFE	5600 bytes
SHA-256: `69eaf326232ae0b4606592b4553d4f7176f1e41a24eaecc406da6356c8c9a99d`
`font_02_sfnt_off0000f317.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF317	11112 bytes
SHA-256: `3df40ecb246e939648dc94512eb224144afc0b44817c7bd4939457d574866e52`

Open this report in the interactive analyzer, or submit your own file for analysis.