PDF malware analysis — malicious · 8287c9675555558d

MALICIOUS

PDF

85.9 KB Created: 2021-09-09 07:06:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26

MD5: 8341394137680677f2f9da49639b892e SHA-1: e2c1a74b9569fc18dc74430c3a0c9e33cffc259b SHA-256: 8287c9675555558d58b7a2ae95e7ea14a333e1a46076a7c5cb7dab67b6c47ce9

146 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains a large number of embedded URLs, many of which point to disposable domains, suggesting a phishing or malware distribution campaign. The presence of 'utm_term=dls+20+android' in one URL indicates a potential lure for Android-related downloads.

Machine Learning

Nyx PDF Classifier malicious score 0.9912

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
QR-code redirect lure medium SE_QR_LURE

Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crewmak.ru/uplcv?utm_term=dls+20+android PDF link annotation
- http://driver-jazda.pl/upload/file/gokijujusoloki.pdfIn PDF document text
- http://www.training4thefuture.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16136d48ec5c4b---kedasenaxevem.pdfIn PDF document text
- http://playonathletics.com/userfiles/file/zosazebojolinaxuvuwibup.pdfIn PDF document text
- http://adamlegal.com/userfiles/file/betibotosamivofo.pdfIn PDF document text
- https://sk-developers.com/wp-content/plugins/formcraft/file-upload/server/content/files/16130c9698de42---58592579185.pdfIn PDF document text
- http://a2itsolutions.com/chop/multimedia/userfiles/file/samujekesisepesanakutor.pdfIn PDF document text
- https://bdblue.com/ckfinder/userfiles/files/71096265693.pdfIn PDF document text
- http://ifap.it/images/file/90207406100.pdfIn PDF document text
- https://www.jancsoalapitvany.hu/ckfinder/userfiles/files/gosutela.pdfIn PDF document text
- https://preprodpcb.com/userfiles/files/42161067601.pdfIn PDF document text
- http://magnumprint.ru/upload/files/58992820332.pdfIn PDF document text
- https://tessuno.com/upload/files/6136c1b675944.pdfIn PDF document text
- http://only-svet.ru/upload/files/14562170918.pdfIn PDF document text
- http://universalestetic.com/userfiles/file/9253944479.pdfIn PDF document text
- http://anthonyvienna.com/sites/default/files/file/7701028956.pdfIn PDF document text
- https://konyaalotaksi.com/userfiles/file/jitirewutoxafikejafegixuf.pdfIn PDF document text
- http://onlinevay.com/upload/files/41781149847.pdfIn PDF document text
- http://iphysiology.ru/upload/tedizof.pdfIn PDF document text
- http://xedaptap.net/userfiles/file/mokisupo.pdfIn PDF document text
- http://alphamarino.kz/images/news/file/65637069795.pdfIn PDF document text
- https://uroci-kursove.com/userfiles/file/widukijogifetemikadunow.pdfIn PDF document text
- http://cnmrobotics.com/files/files/zumepaxejifizagixokixobo.pdfIn PDF document text
- https://inverpalmas.com/aym_image/files/raduvudetirimuzefo.pdfIn PDF document text
- https://tradingphrases.com/userfiles/files/98652059835.pdfIn PDF document text
- https://alexandrapanayotou.com/web/images/static/file/komijofixirasarizipiko.pdfIn PDF document text
- https://thuanxuongmonmb.com/admin/webroot/upload/image/files/97394915855.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ed32.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xED32	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off00010549.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10549	10252 bytes
SHA-256: `cce9d8451023f799e18bcdfda24fd09105bc0a9e361935aa19cc21abd54e5337`
`font_02_sfnt_off00011c63.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C63	17520 bytes
SHA-256: `2fe4465bd9e1088c2283a288e2b72fe7aeb97f617890561c30d743f73049b432`

Open this report in the interactive analyzer, or submit your own file for analysis.