Malicious PDF — malware analysis report

Static analysis result for SHA-256 5bdde71c323c6108…

MALICIOUS

PDF

95.2 KB Created: 2021-03-31 12:30:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 7f035ed3e57ba59a642171ab963459c9 SHA-1: 4aa46074b340088c4edff636530112fc95bad8ed SHA-256: 5bdde71c323c61089a0c5c3027d977569061eb2a035eff124855a5bfe3d7821c
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, many pointing to disposable hosting and redirector infrastructure, indicating a phishing or scam attempt. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' specifically flags a link to a known malicious redirector. While no scripts were extracted, the structure and embedded links strongly suggest a malicious intent to redirect users to harmful sites, likely for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8721

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=ganesh+aarti+lyrics+marathi+pdf In PDF document text
    • http://senenetikoxikom.22web.org/67691275327.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478137/normal_602e67ffbd6bb.pdfIn PDF document text
    • https://cdn.sqhk.co/jerivudofin/g9MGqs2/tiny_army_game_download_for_jio_phone.pdfIn PDF document text
    • https://cdn.sqhk.co/mixubiki/jaeUyfm/gifutefojozenojipika.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367310/normal_60442ee0e759e.pdfIn PDF document text
    • http://miragiwidalupu.22web.org/62103950947.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489035/normal_6045dc6c5bc4c.pdfIn PDF document text
    • http://xexapitanegis.getenjoyment.net/vusaxedojofal.pdfIn PDF document text
    • http://mogimetekojubar.scienceontheweb.net/zemarobu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409623/normal_5ffa5ae0cd73c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://deneboj.rf.gd/famajuvi.pdfIn PDF document text
    • https://s3.amazonaws.com/dutimajizowa/sekif.pdfIn PDF document text
    • https://s3.amazonaws.com/fifuto/16751776826.pdfIn PDF document text
    • http://pavasokunise.epizy.com/wing_chun_kung_fu_training_in_india.pdfIn PDF document text
    • http://jejatoxuselu.rf.gd/87463875610.pdfIn PDF document text
    • http://xofikorib.epizy.com/english_speaking_course_in_gujarati.pdfIn PDF document text
    • http://bodotekufuw.rf.gd/what_are_the_advantages_of_these_technologies.pdfIn PDF document text
    • http://peregal.epizy.com/unilag_2020_admission_list.pdfIn PDF document text
    • http://ruruwuvatokatal.onlinewebshop.net/60736750710.pdfIn PDF document text
    • http://jalebuvubo.myartsonline.com/mijekepuwejez.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107B6 5528 bytes
SHA-256: 79efdfbe0414521df688c20938dc6802c8ac3092a5230394809a01ed9119681c
font_01_sfnt_off00011a60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A60 3720 bytes
SHA-256: d0c9e33916e9e64e42e31bcf0d345f6c2fcd41735b1a34df0119bd0eb1094281
font_02_sfnt_off000125c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125C4 10052 bytes
SHA-256: 1bf176bdd4d7791ac3ba452f7cb2774199c76c89ed2d3718683194d89d8792aa
font_03_sfnt_off00014845.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14845 17632 bytes
SHA-256: 7168c09e4ea50aa0e354bb572d756ab1f7a5d9a7bd00fe5b29e194da7e2d2536

Open this report in the interactive analyzer, or submit your own file for analysis.