PDF malware analysis — malicious · 7be1ed6d1d99dc7e

MALICIOUS

PDF

78.8 KB Created: 2021-02-24 23:07:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31

MD5: 1b6bd64aabd18c3085b7af890eea849a SHA-1: ed6274db4b4531dfc79c195f5e97a68646f0053a SHA-256: 7be1ed6d1d99dc7e3759ba83ecdb9992f08444c4ed933517feb0e9cca7e1326f

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded URLs, many pointing to disposable hosting services, and is flagged as a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. The document body, though heavily obfuscated, suggests a lure related to a legal article, aiming to trick users into clicking the malicious links.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/award?keyword=articulo+115+de+la+constitucion+mexicana+resumido PDF link annotation
- https://gugukufetufa.weebly.com/uploads/1/3/4/3/134337187/1eb0d6112411.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418365/normal_603436295ed99.pdfIn PDF document text
- https://xunujilitaga.weebly.com/uploads/1/3/5/3/135315779/fogimak.pdfIn PDF document text
- https://ziwivebagojub.weebly.com/uploads/1/3/1/8/131871618/d415336e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367903/normal_60367ac489f96.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4457000/normal_602b087810cff.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4486566/normal_602e2411cca67.pdfIn PDF document text
- https://xamoguxa.weebly.com/uploads/1/3/0/8/130874300/4047246.pdfIn PDF document text
- https://wixolovab.weebly.com/uploads/1/3/0/7/130776385/1716603.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4453556/normal_5febf9fd452d8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470540/normal_602c57aa422be.pdfIn PDF document text
- https://vevofuxideg.weebly.com/uploads/1/3/1/4/131405958/luvexegexorupewomuw.pdfIn PDF document text
- https://gedesinikus.weebly.com/uploads/1/3/5/3/135323437/d725750ad3.pdfIn PDF document text
- https://gemunokixelu.weebly.com/uploads/1/3/6/0/136095878/sidabimufo.pdfIn PDF document text
- https://dakubotamijez.weebly.com/uploads/1/3/2/7/132712147/7d9de1d33.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4447646/normal_5ff3226dc70fd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459922/normal_6025a4503649b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/regegozumekoza/lava_eel_guide_osrs.pdfIn PDF document text
- https://s3.amazonaws.com/dikobepibelun/nodelebisikosigonomekanap.pdfIn PDF document text
- https://s3.amazonaws.com/nabifovu/introducing_spring_framework_a_primer.pdfIn PDF document text
- https://s3.amazonaws.com/xufaxoferugod/cabeza_hombros_rodillas_pies_worksheet.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e7ba.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE7BA	5200 bytes
SHA-256: `6cfa112fff4b042e6f8a2d88a42dcfc47e73795344dd5a878f15324bf98dd1de`
`font_01_sfnt_off0000f950.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF950	11356 bytes
SHA-256: `0cf3676652e099828a1afd7bbb509991a5b135126b5adabd82d60dd867c64f89`
`font_02_sfnt_off00011dc2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11DC2	4324 bytes
SHA-256: `d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378`

Open this report in the interactive analyzer, or submit your own file for analysis.