PDF malware analysis — malicious · 8a95fd96d5211c93

MALICIOUS

PDF

78.4 KB Created: 2021-03-23 05:40:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02

MD5: 6438082934339e4c9c61fc5a0174ffd9 SHA-1: 03a4a01f556b17c78c4ede649da8c6cb48be1297 SHA-256: 8a95fd96d5211c93bf4c6230b01609d703b6ecda10d1651ed0d760cab600cc09

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a high-confidence ML classifier and ClamAV, indicating malicious intent. The document body and embedded URLs suggest a lure for potentially unwanted content, specifically referencing 'earthworm jim mobile apk'. The presence of numerous external URIs, many hosted on disposable domains, points to a link farm strategy to redirect users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/wix?keyword=earthworm+jim+mobile+apk PDF link annotation
- http://kizunawinim.getenjoyment.net/kajexupu.pdfIn PDF document text
- https://cdn.sqhk.co/tafolaku/iiRbjbT/4k_gaming_wallpaper_for_iphone.pdfIn PDF document text
- https://cdn.sqhk.co/wadupaxi/hhwjfMU/duvujegagabanedezodiliso.pdfIn PDF document text
- http://wofeboz.66ghz.com/17382058.pdfIn PDF document text
- https://cdn.sqhk.co/sezivalaw/idqLhir/diastolic_blood_pressure_range_pediatric.pdfIn PDF document text
- http://nefozufovi.scienceontheweb.net/do_you_soak_wood_chips_before_smoking_electric_smoker.pdfIn PDF document text
- http://jofifuneku.medianewsonline.com/algorithms_for_optimization_the_mit_press.pdfIn PDF document text
- https://cdn.sqhk.co/mubogasaven/ja8ifCW/download_game_monster_farm_mod.pdfIn PDF document text
- http://kovuzaxaf.medianewsonline.com/resumen_de_el_libro_de_los_muertos_egipcio.pdfIn PDF document text
- http://lenugaguv.medianewsonline.com/dynamic_stretching_for_basketball_players.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://88966db1-4a83-4446-b941-f65022a6235f.filesusr.com/ugd/928e0f_32d3810f403c480d8b97f55e97452414.pdf?index=trueIn PDF document text
- http://woxikajir.myartsonline.com/37289955561.pdfIn PDF document text
- https://f459ab6e-ac57-43ce-b83a-1524846427e4.filesusr.com/ugd/938c70_fba19fe205c94d038dfdac99338e0519.pdf?index=trueIn PDF document text
- https://404c0e03-56c4-4888-bb84-d9d32a71a3e4.filesusr.com/ugd/100e2e_439d49a64f724e52a3bc83d589068eee.pdf?index=trueIn PDF document text
- https://dda5c79a-a75d-44d9-a006-48dec3bfe172.filesusr.com/ugd/115d6e_64f13baaa88b4319bb8255b533cf0631.pdf?index=trueIn PDF document text
- https://79d86aa2-23c4-4aa0-a0dc-c16ac59ae55d.filesusr.com/ugd/ecb701_e90db101962941e290ed189d533672ff.pdf?index=trueIn PDF document text
- https://b724dda4-e2e0-47c5-811c-ae3b7273578b.filesusr.com/ugd/a1e5ee_eaaa394227c24d2aabc70c6e02ad7c48.pdf?index=trueIn PDF document text
- http://muwalolerede.epizy.com/91111817930.pdfIn PDF document text
- https://737c154f-ca75-4484-807d-9d5c19d76377.filesusr.com/ugd/7e84b7_4ba1a76566774cbd92a4940ae4267e41.pdf?index=trueIn PDF document text
- https://0f926834-650c-4d5a-b53c-ad60ae412ccc.filesusr.com/ugd/6a44d8_d6319fb21cea44c2b1dac9e2a750f667.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e5cf.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE5CF	4892 bytes
SHA-256: `e21f9421a8fa0c631a844098d57e01e83638941d5db46450d1cebe93c79f1cd9`
`font_01_sfnt_off0000f681.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF681	11576 bytes
SHA-256: `d2bb170feb512977b7273986cca85f95d0aa215bc6f572dabdbf22d8d88d5859`
`font_02_sfnt_off00011cdd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11CDD	4324 bytes
SHA-256: `7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71`

Open this report in the interactive analyzer, or submit your own file for analysis.