PDF malware analysis — malicious · b695d6bcee89ccfa

MALICIOUS

PDF

123.4 KB Created: 2021-03-14 16:22:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17

MD5: 4e748251495eea6201004845049e756e SHA-1: be6b4a8d1643e51d25ccb08baf9da04ef8d85e65 SHA-256: b695d6bcee89ccfae203a5dfcf51d5eb71f2c8d5ce39b1d5dc154728676565d7

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, many pointing to disposable domains, suggesting a phishing or redirection scheme. The presence of a URL with a 'utm_term' parameter implies tracking or campaign-specific lures, further supporting a phishing attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9993

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/strik?utm_term=will+there+be+a+flight+simulator+for+xbox+one PDF link annotation
- http://tertov.xyz/wikepemutewiredakibwoqdy.pdfIn PDF document text
- https://cdn.sqhk.co/judigirowe/FAjbYVL/ocarina_sheet_music_zelda.pdfIn PDF document text
- https://cdn.sqhk.co/musarawaw/ejcbjcP/interlockedincrement64_not_found.pdfIn PDF document text
- http://ruguwafe.scienceontheweb.net/xetifaxujevivatoda.pdfIn PDF document text
- https://cdn.sqhk.co/jugomuzuteb/Whdmnid/best_punjabi_ringtone_download_djpunjab.pdfIn PDF document text
- http://lnstagramverifiedsbadgesforms.com/993247500761yvb4.pdfIn PDF document text
- http://mirijesuwakug.sportsontheweb.net/probability_and_stochastic_processes.pdfIn PDF document text
- http://reduslimitaly-ufficiale.site/bubble_gum_simulator_roblox_value_listv5v8m.pdfIn PDF document text
- https://cdn.sqhk.co/kimorotadopo/XX87jeS/terminal_emulator_commands_android_list.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4448545/normal_60402ca07c07c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4378606/normal_604d82f112c12.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459774/normal_601b609d2bf84.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4487424/normal_600181eb22b8c.pdfIn PDF document text
- http://bamefidev.mygamesonline.org/lisujazurikik.pdfIn PDF document text
- http://mgacessoria.online/acls_instructor_manualjxaj4.pdfIn PDF document text
- http://hh666o.site/gonotowamizarenetebipaeq3b6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4466673/normal_603015c0e3204.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/afbe796a-42a8-439a-b9e3-07fa301ab56b/black_boy_haircuts_designs.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68b51b08-efaf-40b3-bc38-665b583b015e/57669059644.pdfIn PDF document text
- https://s3.amazonaws.com/gixawetopoli/vakokanuvijuzoj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd0ab437-089c-4ac3-b967-cdc25e922c19/31880503944.pdfIn PDF document text
- https://s3.amazonaws.com/gonafoziguwewe/elkay_lzwsrk_spec_sheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f65397c5-09b2-4994-8a9b-ada0c6bc5656/49622361501.pdfIn PDF document text
- http://salajire.onlinewebshop.net/bupufiwojudaburazujel.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000196fc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x196FC	5284 bytes
SHA-256: `a24830a9012e44fa2789f8a98f5050a8b9549151662ed1193b68036d8cbf2624`
`font_01_sfnt_off0001a8da.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1A8DA	12612 bytes
SHA-256: `89bfb967ba2ac72b426cf263000aa84f80aea12831c95dca2a521ff0081b3ae0`
`font_02_sfnt_off0001d2e1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1D2E1	4324 bytes
SHA-256: `4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3`

Open this report in the interactive analyzer, or submit your own file for analysis.