PDF malware analysis — malicious · 76d509a1f00905ae

MALICIOUS

PDF

81.4 KB Created: 2021-09-17 03:52:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26

MD5: 9271990f8edd7aa027e2a58c78953fa4 SHA-1: d51bdc88a5c5e23043a9132735a2b8e0c63874f5 SHA-256: 76d509a1f00905aec6711a9cb865e81e2a332642513b869fde1868e2790129ad

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and multiple external URIs, indicating an attempt to redirect users to malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' and the presence of numerous URLs suggest a phishing or malware distribution campaign. The embedded JavaScript likely facilitates the redirection or download of a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9949

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://huntic.ru/uplcv?utm_term=download+editor+capcut PDF link annotation
- http://akicgiyim.com/userfiles/file/tegafevupibod.pdfIn PDF document text
- http://www.biosafety.biz/ckfinder/userfiles/files/89983322961.pdfIn PDF document text
- https://peiitw.com/Upload/ckeditor/files/30795681280.pdfIn PDF document text
- http://a1-automotivegroup.com/upload/files/11171238086.pdfIn PDF document text
- https://lerong.vn/wp-content/plugins/super-forms/uploads/php/files/5fa3196af4e75ea63f7f030d09fc52d1/jemorufilepapozosuka.pdfIn PDF document text
- https://karolinanowak.com/userfiles/file/kuzeginu.pdfIn PDF document text
- http://infunplastic.com/d/files/xumisonozedulogimuse.pdfIn PDF document text
- https://skvely-kup.cz/files/file/67781454900.pdfIn PDF document text
- http://tomaszfilipczak.pl/userfiles/file/14007621509.pdfIn PDF document text
- http://twfindia.in/userfiles/files/nabojinadazoxosokarareni.pdfIn PDF document text
- https://oykufestivali.com/ckfinder/userfiles/files/20477688264.pdfIn PDF document text
- http://drukarnia-warszawa.pl/pliki/file/44324596448.pdfIn PDF document text
- https://dunaweb.co/bg_image/files/kufelivufesututisa.pdfIn PDF document text
- https://keiba-like.biz/js/ckfinder/userfiles/files/jetodotadidifafatu.pdfIn PDF document text
- https://maftplayer.net/calisma2/files/uploads/dalaxanarugubafegepomim.pdfIn PDF document text
- http://dichvutheapec.com/upload/FCK/file/vadoravexixixigixun.pdfIn PDF document text
- http://reversetheclocknow.com/ckfinder/userfiles/files/70413733704.pdfIn PDF document text
- https://xosobacninh.vn/webroot/img/files/dilewepatapoxigiridir.pdfIn PDF document text
- https://ratodua.com/contents/files/tivufekozugizuj.pdfIn PDF document text
- https://robustbrakes.com/administrator/imagetemp/file/18337983211.pdfIn PDF document text
- http://puntolinea.org/userfiles/files/83388239858.pdfIn PDF document text
- http://hum-lucknow.org/test/fckeditor/file/goxuvifezomo.pdfIn PDF document text
- http://gidaero.com/upload/fckeditor/file/xutesabaf.pdfIn PDF document text
- http://mariekevanvlierden.nl/survey/userfiles/files/11140036698.pdfIn PDF document text
- https://pelicanfinancialnetwork.net/ckfinder/userfiles/files/4647152417.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dc53.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC53	10528 bytes
SHA-256: `5f48baffbfcebc5315a8878b0c58c6f867ee4a9f39861d6dea534796c9e96f1c`
`font_01_sfnt_off0000f469.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF469	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00010c7b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C7B	16960 bytes
SHA-256: `4d1554952d92ebd8a3e12835322d190ebe791c3fa56f0e0e8ceb59d5ab679217`

Open this report in the interactive analyzer, or submit your own file for analysis.