PDF malware analysis — malicious · 8b0c7ee28607d32c

MALICIOUS

PDF

93.0 KB Created: 2021-04-01 01:50:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 170da6e624ef9d67d9d1927de70009f6 SHA-1: c93ca3a80dc090e957ccab5e096956843fdce295 SHA-256: 8b0c7ee28607d32c5ef8fd3abd1c503e2578ffe56687757be4cc9ada1bb9bb97

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs pointing to disposable domains and link farms, a common tactic for phishing or malware distribution. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to 'Wow classic shadow priest guide pve', suggesting a phishing or scam pretext.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://leonvi.ru/wix?keyword=wow+classic+shadow+priest+guide+pve PDF link annotation
- https://jizimixu.weebly.com/uploads/1/3/4/0/134095846/mebipujafovower.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366978/normal_6023d91a3f10d.pdfIn PDF document text
- https://kunisalopug.weebly.com/uploads/1/3/4/3/134315348/6002533.pdfIn PDF document text
- https://nasavizar.weebly.com/uploads/1/3/5/3/135322571/nelerovotidalamis.pdfIn PDF document text
- http://rkconstructionsucks.com/chapter_4_lord_of_the_flies542zf.pdfIn PDF document text
- https://jibudodenip.weebly.com/uploads/1/3/4/3/134364722/tokunesake.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413005/normal_605637e163f3c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4380858/normal_5fcf006e62651.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485448/normal_601190289228a.pdfIn PDF document text
- https://xopapukewude.weebly.com/uploads/1/3/1/4/131408664/daxidafi.pdfIn PDF document text
- http://iciapp.xyz/19507135919937d0.pdfIn PDF document text
- http://detonic-official.website/neptunia_nep_nepdzmyr.pdfIn PDF document text
- https://nobasaxekomu.weebly.com/uploads/1/3/5/3/135322761/rezak.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/16b7df1c-eebd-471e-84f3-2db432a37627/29964357655.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fbec2615-bd10-43af-b63c-7b0e57c1caac/gagobopune.pdfIn PDF document text
- https://e5acd528-9925-4355-98ed-6c6122c9c19a.filesusr.com/ugd/49fecd_9648978ace714c4b996abed0f2954565.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f515bf08-a24f-4da4-95aa-acc7ff263a81/area_and_perimeter_word_problems_worksheets_6th_grade.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/36853e09-60c0-4a12-b834-14ae9e6ca38d/how_to_use_intimacy_gel.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d7ccf72e-dee0-4471-9a00-5f4643310465/vugabawuruzavefupudu.pdfIn PDF document text
- https://6ddb26ad-aa8e-4a3e-a925-5cef6fc035e1.filesusr.com/ugd/d3d820_54715ae6336849d8a38ec3856185f00b.pdf?index=trueIn PDF document text
- https://bb55feb6-a0c4-48ae-8f72-aea2c45912f8.filesusr.com/ugd/b9801a_673ed5da0ff64b15be2740f27087815e.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010f2a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10F2A	5500 bytes
SHA-256: `035f48937dd85363f0f244a9fc515362ea7b61af6f18a8686f874e4f0ed48692`
`font_01_sfnt_off000121f5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x121F5	14736 bytes
SHA-256: `02fea8c211d479df12d6d5bc83bc09448c4e16864dd59e7f31f12fd5146a9797`
`font_02_sfnt_off00015027.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15027	16060 bytes
SHA-256: `2173a1880e9f774f759393e7d0d28dda91d04d8a3eae6bea41b822770b343b90`

Open this report in the interactive analyzer, or submit your own file for analysis.