PDF malware analysis — malicious · 8c2117c950b1f718

MALICIOUS

PDF

80.7 KB Created: 2021-03-09 05:51:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 925872e25db05d4a5e4595d91d8f7868 SHA-1: b71896f53087d0e02277557d5bbd9026e2883e9c SHA-256: 8c2117c950b1f718f3b6bcd38094bebb77a804360d3f02394b50b46e62d18b7b

104 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing lure, specifically referencing 'Adobe audition 2019' in its document body and utilizing a redirector URL with a search term related to the software. The presence of embedded URLs and the ML classifier's high confidence score suggest malicious intent, likely to deliver a second-stage payload or phish for credentials.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK

PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://zajinet.ru/123?utm_term=adobe+audition++2019 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4450504/normal_5fc766635e4cc.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4369494/normal_5fc576cdd1166.pdfIn PDF document text
- http://buwovavozu.getenjoyment.net/gawopavekoraduz.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4458633/normal_5fde91b15da38.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4369316/normal_5fca85be8da39.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4427523/normal_5fd18bda9e4d5.pdfIn PDF document text
- http://xubanapirobula.mypressonline.com/which_city_is_less_cold_in_canada.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462374/normal_603ecd5d13c7f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403120/normal_6023e7286baf9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480594/normal_60353c20385e6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4484399/normal_5ff6202993cfa.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4497638/normal_5fff9ada7944f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4424991/normal_6018f5b85ae6d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4465127/normal_5fe62ad3dbd1e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417030/normal_600534a3bb5b5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383577/normal_600de3bdc83db.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/687de360-ae32-4108-a4c1-3a58af92eeea/what_disorders_are_on_the_autistic_spectrum.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee01da44-8bbf-423e-b18b-72b7af889a65/pukotopabapaxefas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7d6ddf74-9a3c-4cf3-b2da-c1e73b9ccf21/ligisamasixujalidabijuf.pdfIn PDF document text
- http://novogizeboje.myartsonline.com/muvufonumu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b3eb2494-16ff-4051-af76-8301cdc3ea20/dizimexopubinabibasipizid.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/95892337-5c52-4ec3-a70c-b6801d2d5238/resibafusokukoxoga.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a347efdd-bdb9-41da-82d4-f95b023f1f67/nebipodezu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc2b22e8-96a7-4777-9260-d478406c34ee/thule_roof_rack_extender.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b3be598f-9e18-4c48-b00e-e5872eccf927/35161682782.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f26f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF26F	5008 bytes
SHA-256: `67bf1d2abff7f5284d34fc01e6567a9ff616388d7f6c6c540a0b48ec6e8ecc62`
`font_01_sfnt_off00010387.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10387	10356 bytes
SHA-256: `b25aa4881a9aa5c4090b669f24856063ffa1ea86de614a738a8586f683fb922d`
`font_02_sfnt_off000126cb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x126CB	4324 bytes
SHA-256: `ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230`

Open this report in the interactive analyzer, or submit your own file for analysis.