PDF malware analysis — malicious · bcb4590ac378b577

MALICIOUS

PDF

83.0 KB Created: 2021-03-10 02:20:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20

MD5: 14c8fff70f47945c7be7311312f697b1 SHA-1: 77fb84f03a8d7fdd9b3a6b5b081734369c4ae7b3 SHA-256: bcb4590ac378b5778530254988792db8b9f3b69c6109ab7380d8e7247e709ab8

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external URIs, many pointing to disposable hosting, indicating a link farm or phishing lure. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware distribution attempt, likely leveraging spearphishing attachments as the initial access vector.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/award?keyword=relevance+of+adolescent+psychology+pdf PDF link annotation
- http://wisitens.online/34295841450utca7.pdfIn PDF document text
- http://qwertyujg.xyz/what_causes_visual_and_auditory_hallucinationsgowzp.pdfIn PDF document text
- http://ukrinsure.com/information_technology_definition_and_examples9mdk0.pdfIn PDF document text
- http://idealica-ordina.site/40035124205ow4dt.pdfIn PDF document text
- http://ketotreno.buzz/336801306173mldg.pdfIn PDF document text
- http://apsmall.space/rejepeness5w.pdfIn PDF document text
- http://teksol.xyz/wuzakafodisoparalege9ia.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/xeponodij/pogonubenun.pdfIn PDF document text
- https://926da24b-d3df-4aea-ac1b-ebdf7359a9e7.filesusr.com/ugd/fef925_c5047f11d06949d0b3f9885813aab9ce.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/bab6e995-8023-47ac-ab93-59d76898a499/fairy_tail_high_school_ova.pdfIn PDF document text
- https://d23eb412-52e1-45ef-a32a-0c032022daee.filesusr.com/ugd/03485a_eabf08fa9bd74017a6fa22ac4365a787.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/5ec61c98-2fff-475c-b6ee-f12372040fc0/63003543727.pdfIn PDF document text
- https://fac30f9c-1bc3-4ff6-ac40-7ced1d2a170b.filesusr.com/ugd/3b7182_2a879e9c8bfe46f3bda89166cd450f34.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/414d5b4c-1a46-4487-b37c-7163afe1cfba/40944713498.pdfIn PDF document text
- https://6f8cb219-4830-455d-9ced-b55e65700e85.filesusr.com/ugd/fd30ac_fa2da7fc8d6c4539b1501d513218c664.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3d629ea8-cd60-4264-938a-fa4b06507dcd/rezepoxewubumilap.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d113093c-3121-465c-ba35-7ed1371b2c75/girugebej.pdfIn PDF document text
- https://144c9d4d-401b-437b-b89f-6a5816d7da47.filesusr.com/ugd/cd33f5_25004e544fbd4d259e9bb905f45c3acb.pdf?index=trueIn PDF document text
- https://dab7fb03-f2af-4a8e-9cb9-31de623bedb3.filesusr.com/ugd/58b596_661f7abe2c914a37bf405623e9c48f0f.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/juvuraguvutoxif/72746910240.pdfIn PDF document text
- https://f3b8d348-8566-49c9-a9f8-a2c3b9e1bc8e.filesusr.com/ugd/f1c748_f247e26d1f7b47c181d763c722b9b72f.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fa25.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFA25	5232 bytes
SHA-256: `5aa6a04108d51f6db2c78730909b5b30211c6588c3aa706bb0288dacdffb3928`
`font_01_sfnt_off00010c05.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C05	10608 bytes
SHA-256: `92944a6358c23e5bc0cb256ad66de29ea4c3b910b31e46bab429ac239bd94423`
`font_02_sfnt_off0001304d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1304D	4324 bytes
SHA-256: `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`

Open this report in the interactive analyzer, or submit your own file for analysis.