PDF malware analysis — malicious · ba71a3bcda7d66bc

MALICIOUS

PDF

71.4 KB Created: 2021-03-06 23:29:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23

MD5: 13bb87e2b8e2e840cd1f1f8f864abc98 SHA-1: 69d0cbb6a2e8c6557c653e77a600488df39dfdd5 SHA-256: ba71a3bcda7d66bc0aa578c1ea48dc8537533f6d159b990c77282c10054a4c7f

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs and is flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan distribution vehicle. The document body, though heavily obfuscated, contains text related to 'Sub zero 36 inch refrigerator dimensions', suggesting a lure to trick users into visiting the linked sites. The presence of multiple external URIs and link farm heuristics indicates a strong intent to redirect users to potentially harmful content.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ponafet.ru/strik?utm_term=sub+zero+36+inch+refrigerator+dimensions PDF link annotation
- http://50offstore.pro/96900707282x2wul.pdfIn PDF document text
- https://cdn.sqhk.co/korebuxaguz/flhfggX/mojejibalojamozifelon.pdfIn PDF document text
- https://cdn.sqhk.co/sudizatase/khghije/78012195733.pdfIn PDF document text
- https://cdn.sqhk.co/xafeperale/gghdgj1/i_wish_apple_store_ujjain.pdfIn PDF document text
- https://cdn.sqhk.co/zimuteraf/WRhdhg5/69070353142.pdfIn PDF document text
- http://pannochki-art.com/pimesesopiwoxhy0h.pdfIn PDF document text
- http://nonowun.mywebcommunity.org/vamugetovotepadatevo.pdfIn PDF document text
- http://wildber.store/lomudafimotitudajsipow.pdfIn PDF document text
- http://basidugom.mygamesonline.org/baleriw.pdfIn PDF document text
- https://cdn.sqhk.co/nakokixega/dajbcb5/superhero_the_ninja_warrior_mod_apk.pdfIn PDF document text
- http://antonio-ita.space/87856077495cpcf9.pdfIn PDF document text
- http://rexonina.medianewsonline.com/91395466504.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://diwavubodinaroj.myartsonline.com/xepazan.pdfIn PDF document text
- https://569e8712-2873-4b93-a654-ea71b6b809e3.filesusr.com/ugd/345929_f102a7b0e5e74a098f54a8a30e28c87c.pdf?index=trueIn PDF document text
- https://45f91bdd-2b68-4e60-ae2c-b14373ae5332.filesusr.com/ugd/0d089b_27458b75992d4b6391356bf56fbf15c0.pdf?index=trueIn PDF document text
- https://8fc1c2d6-49ba-4d63-8b95-0327ef2b1627.filesusr.com/ugd/1849a1_2129161f5b9541659c2385d349339b68.pdf?index=trueIn PDF document text
- https://676a7a22-5bec-432e-92e0-9d4a0a27851c.filesusr.com/ugd/a1fb72_33fde51a1dc944f19caa8b3e505d2b69.pdf?index=trueIn PDF document text
- http://nizowozutagele.atwebpages.com/gigedutuwimadedilodu.pdfIn PDF document text
- https://14319df0-7947-4f0d-bbb3-eaa17d5eb23e.filesusr.com/ugd/c45f38_7d4aa5e944464796865e64fee0235064.pdf?index=trueIn PDF document text
- http://zuvuzevo.atwebpages.com/woxuwosuwijatetuvomoluji.pdfIn PDF document text
- https://ef9935f7-a918-44a1-999f-f1d50a45e4a7.filesusr.com/ugd/b463f2_ab67982a87a140ca9ba0112701949106.pdf?index=trueIn PDF document text
- https://5ee0d2ad-6486-47ce-ab7d-0e7b2bae4193.filesusr.com/ugd/bc0d1e_49fc083d55374e188aa00f9dd817d7b8.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ca7f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCA7F	5896 bytes
SHA-256: `8e7b5f4fa48de420a920ac2b5acce796d1206588d72ee7c16a591ef4d4e985e8`
`font_01_sfnt_off0000de5b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDE5B	10360 bytes
SHA-256: `85110f2840c0c75fe348cd24e14ac0c8431e0bfdcc454b865abb0bee559eb3fd`
`font_02_sfnt_off000101da.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x101DA	4324 bytes
SHA-256: `7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71`

Open this report in the interactive analyzer, or submit your own file for analysis.