PDF malware analysis — malicious · 8b4803679c90d112

MALICIOUS

PDF

76.5 KB Created: 2021-03-10 14:14:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20

MD5: 5d743895789d2ca85e55a474d7250cf0 SHA-1: 29b72aff495e07f952378be73bdfaca8cc1cfcbb SHA-256: 8b4803679c90d112d7322168dae3f6f7f002bb99438a32cd735f787130f85210

166 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains multiple heuristics indicating malicious intent, including PDF_SEO_DISPOSABLE_LINK_FARM and SE_PAYMENT_REDIRECT_LURE. The ML classifier and ClamAV detection strongly suggest it is malicious. The primary IOC is a URL that appears to be part of a phishing or redirection scheme, likely aiming to trick users into believing they need to update payment details.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE

Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/strik?utm_term=calculator+apps+to+hide+photos PDF link annotation
- https://static.s123-cdn-static.com/uploads/4453721/normal_5ff6260b46ecb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4482629/normal_601cb2a28dd5d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://ad9e3d1f-bb22-46ca-892e-b6aa3325a756.filesusr.com/ugd/837d34_6121f7fe196d41d1ae18941389be905c.pdf?index=trueIn PDF document text
- https://9610c43f-1b2a-4a8a-b660-75aaf3908198.filesusr.com/ugd/286fb8_d171c472c2d54285ae1d6d2c0a6865da.pdf?index=trueIn PDF document text
- https://28ed73df-463f-41d7-bc87-4635118fd8e0.filesusr.com/ugd/74acc8_e45d88b7db6a44f7b1bb1efdd37cf48b.pdf?index=trueIn PDF document text
- https://aa3bb5c3-2bd4-4791-9e2a-6e31d5009b04.filesusr.com/ugd/60e703_78d0348f2de5449cad0e5c2a5dee4854.pdf?index=trueIn PDF document text
- https://5fdaa9e0-ad6d-443b-8779-beb8e45026dc.filesusr.com/ugd/05301a_f9f0ea65fc684616acb7191d6ca695fa.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/62bf95a2-433f-458f-a51c-cf205634f508/kakerafaparunug.pdfIn PDF document text
- https://s3.amazonaws.com/varoximu/84836863895.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9063b013-5fe5-4b30-966d-8fb079a437b0/16016346223.pdfIn PDF document text
- https://s3.amazonaws.com/vuxagixil/dibewuvafirukin.pdfIn PDF document text
- https://s3.amazonaws.com/vigevot/social_learning_theory_examples_in_media.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/495e61e9-9ba2-4ec1-8b85-2ce19edbb680/kumubepuzemapaguwufox.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d913320f-ab4f-47c7-9ed4-c008bda9a638/audio_technica_at-lp60x_belt_drive_turntable.pdfIn PDF document text
- https://91c7bc9f-df77-4dbd-ae51-8bcf521f3e61.filesusr.com/ugd/1df9ea_ab4fbb0ca0494c4c921f9127234e2508.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/9c3284c5-e42e-4a03-80f6-e5db67c64590/zedoribanedofigusosoxidu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/34ee2199-97e1-43ee-ae6c-cf8c0a827f13/dell_xps_8500_bios_settings.pdfIn PDF document text
- https://s3.amazonaws.com/gogunabones/structural_features_of_an_information_report.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8b3d0375-debf-47fd-93d9-9a09a7660422/cuisinart_k_cup_coffee_maker_not_brewing.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ee56.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEE56	5064 bytes
SHA-256: `ac5f1ca1d1bc391d269166a4f230bf6ef29bd56dd9539406ac430e8779a925f3`
`font_01_sfnt_off0000ff7f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFF7F	11328 bytes
SHA-256: `c4210313dfa658bb2f702bc4c27822cd56e8b6a9cfbe5510f39023c31ba9175c`

Open this report in the interactive analyzer, or submit your own file for analysis.