PDF malware analysis — malicious · 5f8f36501a47bc2d

MALICIOUS

PDF

73.6 KB Created: 2021-09-16 05:42:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: 4860d329b70501c3172839046f9aa609 SHA-1: 6fdf2529388e120b1a932c688d853fa043a660ba SHA-256: 5f8f36501a47bc2d80370e9eb1ef514751ecec638fb3812a09c31d74f7c537be

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample is a PDF file flagged as malicious by ClamAV and an ML classifier. It contains embedded JavaScript and a large number of external URIs, many of which are hosted on disposable domains and appear to be part of a link farm. The presence of JavaScript and numerous links suggests the document is intended to redirect users to malicious sites, likely for phishing or to download further malware. The `utm_term` parameter in one of the URLs indicates a potential phishing lure related to 'fishing strike mod apk'.

Machine Learning

Nyx PDF Classifier malicious score 0.9951

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://allytemp.ru/uplcv?utm_term=fishing+strike+mod+apk PDF link annotation
- http://vxclouds.com/userfiles/file/55647693275.pdfIn PDF document text
- http://ozgu-yapi.com/firma/files/84066892164.pdfIn PDF document text
- http://www.patriarca-batiment.com/ressource/site-image/files/zepumaligosefodojizokufe.pdfIn PDF document text
- http://joyear.com/ckfinder/userfiles/files/zexawaxanatujopusesunesu.pdfIn PDF document text
- https://servauto.fr/img/user/file/23017158235.pdfIn PDF document text
- http://solamsys.com/userData/board/file/88678806461.pdfIn PDF document text
- http://sjzhtchem.com/upload/files/folepiderenod.pdfIn PDF document text
- https://eldorado777.ro/upload/editor/file/15071644419.pdfIn PDF document text
- http://abwmercury.com/uploads/files/rawofuwiwomojeb.pdfIn PDF document text
- https://5udua.com/contents/files/sojajizirojijataxub.pdfIn PDF document text
- https://razredna-nastava.net/files/66126836260.pdfIn PDF document text
- https://lifesmart.lifesmart.ro/ckfinder/userfiles/files/13115829048.pdfIn PDF document text
- https://pre-www.bridge-college.com/uploaded/ckeditor/files/57336926890.pdfIn PDF document text
- http://siripanyalamphun.com/user_img/files/19892436189.pdfIn PDF document text
- http://hkalc.com/userfiles/ludinakilelu.pdfIn PDF document text
- https://soudurelauziere.ca/upload/editor/file/woveseritokikuxuwuvinuvus.pdfIn PDF document text
- https://sitycare.com/FCK-UserFiles/files/diwole.pdfIn PDF document text
- http://carshopm.com/js/upload/files/49987576884.pdfIn PDF document text
- https://inprovitpuertorico.com/ckfinder/userfiles/files/30447711832.pdfIn PDF document text
- https://avistravel.ro/userfiles/file/15171628238.pdfIn PDF document text
- http://pescepiana.eu/userfiles/files/ruxatagibinewidulokesa.pdfIn PDF document text
- http://www.tivafa.hu/upload/file/sagubulutev.pdfIn PDF document text
- https://t4g.nasscomfoundation.org/wp-content/plugins/super-forms/uploads/php/files/a2g00g3c7esa6h5l1aseevcgl1/55643188005.pdfIn PDF document text
- http://murielbellhomes.com/userfiles/files/68355621620.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bea3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBEA3	10860 bytes
SHA-256: `4b9441c7dbbb8ca3f1c08f0f70105575f401c4000ccf04a048c75d794b140a6a`
`font_01_sfnt_off0000d74a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD74A	16376 bytes
SHA-256: `fe4303fcbe188976eaa4db7cc5f1c0b43a9f4561e1a6d93392dbdcbddce5d049`
`font_02_sfnt_off00010144.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10144	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.