PDF malware analysis — malicious · 591bb3011f1a30ff

MALICIOUS

PDF

86.7 KB Created: 2021-09-19 06:20:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: 31d2d89e5b5a9f85940169b3b1402ffa SHA-1: a9a271b134faae2f12fd5008cdcbc65fddddc1ee SHA-256: 591bb3011f1a30ff9977e22dfb278cb822d6a89997f531edbe50c08b9cbd9e3a

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier flagged it with high confidence. It contains numerous embedded URLs, many of which point to disposable domains and are structured as link farms, indicating a phishing or malware distribution attempt. The PDF itself appears to be malformed or obfuscated, as suggested by the 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristic and the presence of duplicate object bodies.

Machine Learning

Nyx PDF Classifier malicious score 0.9942

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://aerotechgroup.ru/img/outer/files/80418102405.pdf In PDF document text
- https://cashcruis.ru/wp-content/plugins/super-forms/uploads/php/files/99740768b3f7f6ca5746d231e82e1307/zigesulokokusibasuforake.pdfIn PDF document text
- https://fenixfalt.com/userfiles/file/61301260043.pdfIn PDF document text
- http://mikol-styl.cz/userfiles/file/xojuvogejor.pdfIn PDF document text
- http://falconltd.pl/cache/file/repaxopowoludup.pdfIn PDF document text
- https://trisyscom.com/userfiles/file/morejigafev.pdfIn PDF document text
- http://urs-certification.com/gais/image/file/12616988568.pdfIn PDF document text
- https://akapacha.com/userfiles/file/xitasasimoxigogurifexav.pdfIn PDF document text
- http://i-daa-wl.de/userfiles/nulusazukadukajufasenowot.pdfIn PDF document text
- https://cfi-registration.org/buzzboxgift/img/userfiles/files/48052998503.pdfIn PDF document text
- https://sapsda.org/SapmaUserfiles/file/pivaluriwofopav.pdfIn PDF document text
- http://maturitni-ples.eu/UserFiles/File/kutakametetimoja.pdfIn PDF document text
- http://marikitaberbagi.com/userfiles/file/dikotep.pdfIn PDF document text
- http://amghanoi.com/images/ckeditor/files/bowakusidolud.pdfIn PDF document text
- http://asesoriagarpe.com/wp-content/plugins/formcraft/file-upload/server/content/files/16139304b35b29---sidobipigus.pdfIn PDF document text
- https://bacsionline.net/userfiles/file/regebigejivufixavo.pdfIn PDF document text
- http://krukaiart.com/userfiles/files/jetif.pdfIn PDF document text
- http://ballarioarchitetti.eu/userfiles/files/xuweninuwoz.pdfIn PDF document text
- http://greenglobepms.com/uploads/ranoletarun.pdfIn PDF document text
- http://vitalbafitnessclub.eu/userfiles/files/turezijumajizinubip.pdfIn PDF document text
- http://wpklaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/jojumebepazoxisuta.pdfIn PDF document text
- http://htbestcomputer.com/media/ftp/file/65065208319.pdfIn PDF document text
- http://www.miyadenthai.com/image/upload/File/4344302802.pdfIn PDF document text
- http://parmalab.it/userfiles/files/26385095917.pdfIn PDF document text
- http://btsoft.vn/uploads/files/29351055519.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=moderato+cantabile+pdfPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eaa6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEAA6	19340 bytes
SHA-256: `85b726843fb0268b6da69875f59ec82a01be815295c4fe1e2ec48eb1d0e74603`
`font_01_sfnt_off00011d9e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11D9E	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off000135b5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x135B5	10580 bytes
SHA-256: `277688ed780ba5701dd79748a4b63fd06e23d26dbdb5da3c3de674275c61d86a`

Open this report in the interactive analyzer, or submit your own file for analysis.