PDF malware analysis — malicious · 629e3f0af9941f31

MALICIOUS

PDF

99.8 KB Created: 2021-03-11 13:32:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11

MD5: be0b601c424293cdbb776676e4c517ce SHA-1: ba012f19a9e81a114fa7d39772ab2ad79d1d07a6 SHA-256: 629e3f0af9941f316cbeb0a15b714cbbd569ba7884e2f7f613a75a94fbddce4b

184 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs pointing to potentially malicious or disposable domains, as indicated by the 'PDF_MALICIOUS_REDIRECTOR_LINK' and 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristics. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the nature of the embedded links and the PDF structure points towards a phishing or malware distribution campaign, likely initiated via spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/award?keyword=engineering+mechanical+drawing+pdf In PDF document text
- https://cdn.sqhk.co/papedajapej/gHhg9bJ/deven.pdfIn PDF document text
- http://peteferix.mypressonline.com/sizedeguvugaxo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446915/normal_603549e3c0d72.pdfIn PDF document text
- http://haustova.com/81372837404kbzdt.pdfIn PDF document text
- http://hesap-al-sat.com/eye_of_the_beholder_computer_game5h4t4.pdfIn PDF document text
- http://wiinorama.space/shelter_insurance_columbia_mo_zip_code1t8vv.pdfIn PDF document text
- https://cdn.sqhk.co/zurefaxenov/cHgeWsi/32582192800.pdfIn PDF document text
- http://tepugorotewole.medianewsonline.com/honda_bf90_service.pdfIn PDF document text
- http://reassurez-moi-fr.info/how_to_program_vizio_tv_to_xfinity_remoteug3el.pdfIn PDF document text
- http://maewallace.com/zofedovutuxt4wno.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367312/normal_600a88cf835ec.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411503/normal_60215cd4941ab.pdfIn PDF document text
- https://cdn.sqhk.co/vemegunir/jaifgi7/spaceflight_simulator_rocket_blueprints_download.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4449397/normal_603271be124ae.pdfIn PDF document text
- http://study-english-02.space/pebetumedulerozamafitoqznpm.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4458144/normal_60198c395a0d1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4473432/normal_6037514defc13.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412394/normal_5fea3695f106d.pdfIn PDF document text
- https://cdn.sqhk.co/lilavokolet/gcijehh/17125285103.pdfIn PDF document text
- http://pro-konditer.com/japorividu0uoin.pdfIn PDF document text
- http://sarhello.online/bupiniguzezilefivapozoffhya.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://livirava.atwebpages.com/wuxobedami.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000136f3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x136F3	5440 bytes
SHA-256: `639505a0e110df734a45543acb698f5f9fd3672f1f76b50831844bff8bf57afa`
`font_01_sfnt_off00014965.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14965	10132 bytes
SHA-256: `0e966bb5132c754cb78b920856460a359fddbfa169ecacdb0bc27b5559311b4c`
`font_02_sfnt_off00016c58.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16C58	16172 bytes
SHA-256: `852e0d6ce07a1db2e11154f4548aec4dc29a2cf073112f8b6a2b4be1be4894b3`

Open this report in the interactive analyzer, or submit your own file for analysis.