PDF malware analysis — malicious · 8bd4f8ef840efb9f

MALICIOUS

PDF

76.2 KB Created: 2021-06-04 03:46:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 7c0d0084eb7e121cbc3232b0bd6ec3ed SHA-1: a7b4c57f311f68d491933a64c1f37bf8d12400a1 SHA-256: 8bd4f8ef840efb9f7fb29f9dd5a454adcc29670cb2cecea8f30a89dc433c74bb

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as malicious and a machine learning classifier indicated a high probability of maliciousness. The document contains numerous embedded links, many of which point to disposable domains and are designed as a link farm, suggesting a phishing or redirection attempt. One specific URL, https://queure.ru/pbw?utm_term=whatsapp+uptodown+apple, is particularly suspicious and likely leads to a malicious payload or phishing page.

Machine Learning

Nyx PDF Classifier malicious score 0.9948

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://queure.ru/pbw?utm_term=whatsapp+uptodown+apple PDF link annotation
- https://jawimuxuketeg.weebly.com/uploads/1/3/4/7/134763527/2711718.pdfIn PDF document text
- https://devoligoj.weebly.com/uploads/1/3/7/5/137509872/vexuz.pdfIn PDF document text
- https://zaluzukefajol.weebly.com/uploads/1/3/5/4/135400247/gojakojig.pdfIn PDF document text
- https://kibinopojisetux.weebly.com/uploads/1/3/4/6/134662243/9788841.pdfIn PDF document text
- https://lijoliwaxodoxi.weebly.com/uploads/1/3/1/3/131398144/bubojipuloximake.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://tubekikewabi.pbworks.com/w/file/fetch/144459567/how_many_calories_in_sonic_oreo_cheesecake_shake.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f8b72c7c-9e98-4d94-9155-bce23a28fc4e/rezesuzokojofuvixeminut.pdfIn PDF document text
- http://rugewenuzed.pbworks.com/w/file/fetch/144421224/magimediwewexomorofitanuk.pdfIn PDF document text
- http://pezeliv.pbworks.com/w/file/fetch/144423864/kapikuwuvejesewunane.pdfIn PDF document text
- http://gitizuxob.pbworks.com/w/file/fetch/144578832/acrylic_acid_production_process_from_propylene.pdfIn PDF document text
- http://gibuwodebu.pbworks.com/f/how_to_delete_page_break_in_microsoft_word_2010.pdfIn PDF document text
- http://poxanoralanu.pbworks.com/w/file/fetch/144569541/diary_of_a_wimpy_kid_2_full_movie_watch_online_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f418589d-337d-4905-a149-ff2da2fe4f8c/wukamutugexupujaso.pdfIn PDF document text
- http://ziludezubeju.pbworks.com/f/51796266480.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c63a0bf6-a22c-440c-aa19-11aedb5a1e7d/nekosufenakerozula.pdfIn PDF document text
- http://vamafob.pbworks.com/w/file/fetch/144474213/partnership_deed_sample_doc_pakistan.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8416c619-6cc1-454a-b9c3-42e4865af5e3/planeaciones_lainitas_tercer_grado_noviembre.pdfIn PDF document text
- http://kokoxudalux.pbworks.com/f/encyclopedia_judaica_vol_21.pdfIn PDF document text
- http://ronakiko.pbworks.com/w/file/fetch/144538167/lilubanaveku.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dbf1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDBF1	5056 bytes
SHA-256: `40c3e60272cf5f4026362b23f6f436b7800d8ea4ddceeb3bbf400344ea012cc9`
`font_01_sfnt_off0000ed38.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xED38	12796 bytes
SHA-256: `a08b042ad28586468328bd5852af32df15e806e289509b5e8ada195aa8c65d06`
`font_02_sfnt_off00011663.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11663	16168 bytes
SHA-256: `e5458d7b6d82539349b17fc4713a17e1381d471255c72d9f8116b7c86e08c443`

Open this report in the interactive analyzer, or submit your own file for analysis.