PDF malware analysis — malicious · 84f088137bedc866

MALICIOUS

PDF

79.1 KB Created: 2021-05-06 20:00:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22

MD5: 4749cf1ab7ae24b90b3ea7948c11d2a7 SHA-1: 203047a9028ada121d6c96d64902827e240236c3 SHA-256: 84f088137bedc866800fa03ac9a3c594853ef89a5db2524eac7a97a10fc45779

206 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged by ClamAV as malicious and by an ML classifier. It contains multiple heuristics indicating social engineering, specifically a 'ClickFix' lure that instructs the user to copy and paste commands into a terminal (e.g., Run, PowerShell, cmd). This strongly suggests the document is designed to trick the user into executing a secondary payload, likely downloaded from one of the embedded URLs.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
ClickFix social engineering attack high SE_CLICKFIX

Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/strik?utm_term=factory+reset+command+prompt+windows+10 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4369505/normal_606d6add8a881.pdfIn PDF document text
- https://gejimedetudumi.weebly.com/uploads/1/3/3/9/133997730/wurufazakaj-luxutadogireje.pdfIn PDF document text
- http://albatros-trans.ru/bibiliya_ntagatifu_kinyarwandaerm8p.pdfIn PDF document text
- http://oneitstore.pro/cognitive_behavioral_therapy_interventions_for_depressionthzjl.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4368469/normal_5ffabfd29b60a.pdfIn PDF document text
- http://curvepreloved.com/51881959491ry7so.pdfIn PDF document text
- https://jesakejijubew.weebly.com/uploads/1/3/4/5/134577011/5f9bec5d002553.pdfIn PDF document text
- http://pasetbs.xyz/the_current_financial_reporting_environmentm7r0a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385852/normal_602539450729f.pdfIn PDF document text
- http://idealsit.fun/50585171425vfzmy.pdfIn PDF document text
- http://mirror-x.org/dragon_age_origins_companions_modfhgv7.pdfIn PDF document text
- https://metojonokodoto.weebly.com/uploads/1/3/4/8/134881876/jusavorikegale.pdfIn PDF document text
- http://natur-bio.space/microsoft_wireless_keyboard_2000_usb_replacementc59dd.pdfIn PDF document text
- http://vzruvayarttraff.xyz/424081875512uefx.pdfIn PDF document text
- https://vepufekuso.weebly.com/uploads/1/3/0/7/130775624/2822858.pdfIn PDF document text
- https://gisoroweri.weebly.com/uploads/1/3/4/8/134893792/8252492.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365646/normal_604d2c812b2e7.pdfIn PDF document text
- https://tulapubilogu.weebly.com/uploads/1/3/4/8/134881906/2659985.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375522/normal_5fd7e39dbe227.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4413718/normal_5fcbfeeb1f48b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e9af.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE9AF	5316 bytes
SHA-256: `09fb44d4b72aba95a663a09a9edef0ee1d05eb70c5cbb4984b38eb506ba6cf2d`
`font_01_sfnt_off0000fbc0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFBC0	10844 bytes
SHA-256: `5f006ea14a1738bafc8b640b0cedc924f904c43c27ddc50a3e621c4c048c9a3c`
`font_02_sfnt_off000120e9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x120E9	4324 bytes
SHA-256: `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`

Open this report in the interactive analyzer, or submit your own file for analysis.