PDF malware analysis — malicious · a541d15336da4d04

MALICIOUS

PDF

75.9 KB Created: 2021-03-12 14:01:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10

MD5: 3d586297fa93bc37e16bccce3f2a16df SHA-1: 0a95f5ed553ae1b581fc2aad4e38cd9d9ae3aff2 SHA-256: a541d15336da4d047e4bea5cad11fa545d3cb429a81e9a7d411aa9f8e7d12423

214 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by multiple heuristics, including a critical alert for linking to known malicious redirector infrastructure and a high-confidence ML classification. The document body, though heavily obfuscated, suggests a lure related to an '18th birthday invitation' template. The presence of numerous embedded URLs, many pointing to external PDF files, indicates a link farm or redirection scheme designed to lead users to malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9960

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dafemum.ru/123?utm_term=template+for+18th+birthday+invitation In PDF document text
- http://ionatr.space/dinuvaxujifuwtam8k.pdfIn PDF document text
- http://potenciy.xyz/5_trx_exercises_for_a_stronger_backzol4c.pdfIn PDF document text
- http://itdiscounts.info/874232436337mmp7.pdfIn PDF document text
- http://dfds.in/82174884173498wt.pdfIn PDF document text
- http://golden-charm.ru/analysis_of_data_proceduregj28e.pdfIn PDF document text
- http://barefevevudan.iblogger.org/9129571761.pdfIn PDF document text
- http://koteyarn.moscow/pavogezopinoxujaoq1i7.pdfIn PDF document text
- http://salearea.pro/toxifelaf7hk0i.pdfIn PDF document text
- http://checkmycredit.info/stanley_15_amp_battery_charger_bc15bs_manualc15f4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/semuxemakaw/sulepotoxur.pdfIn PDF document text
- https://ffb80149-315c-4936-8637-e87477b606fc.filesusr.com/ugd/e7410d_3bb93bf6e0fd4940ac7198616f004367.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/defipedibe/zezaludomujesozazawi.pdfIn PDF document text
- https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_945c356667934f13af9edd7fdeddd5e0.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vonutavekip/azania_umzuzu_music.pdfIn PDF document text
- https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_dafcb7f478e6472a943a8f99441c0531.pdf?index=trueIn PDF document text
- https://f730d15c-1921-46d2-b6d4-288333e40990.filesusr.com/ugd/e2c223_874add036b2f48d49ab11574d47af4f2.pdf?index=trueIn PDF document text
- http://tuxavilewik.rf.gd/belazurevexuxo.pdfIn PDF document text
- https://s3.amazonaws.com/makumapikeze/chase_online_app.pdfIn PDF document text
- https://80172413-d145-4b71-b7cf-4a007d76ad29.filesusr.com/ugd/cacfd7_5427ce7a92cb4a5eb86525ac466c8ed5.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wuvepilamamuse/new_barbie_doll_photos.pdfIn PDF document text
- https://s3.amazonaws.com/gebukil/fiwerosirufuzogovevo.pdfIn PDF document text
- http://nasukenapab.epizy.com/three_fund_portfolio_performance.pdfIn PDF document text
- https://s3.amazonaws.com/fibesezati/latifepoxurorukuto.pdfIn PDF document text
- https://s3.amazonaws.com/niwotipugonuvoz/xuvuxakawebobo.pdfIn PDF document text
- https://s3.amazonaws.com/zebarufuridorur/xewagu.pdfIn PDF document text
- https://s3.amazonaws.com/kotenu/the_alliance_alive_hd_remastered_trophy_guide.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ea7e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA7E	5600 bytes
SHA-256: `93e3251c01d4684dd1d50549e377af0b12ab220b92e62636ba84bd86741148a6`
`font_01_sfnt_off0000fd6b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD6B	10648 bytes
SHA-256: `aca71f94d18a11096b34af8844995987469637575417eadea8b47cfdae6ad772`

Open this report in the interactive analyzer, or submit your own file for analysis.