PDF malware analysis — malicious · bd71daad924fec55

MALICIOUS

PDF

82.4 KB Created: 2021-04-06 20:35:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 5d57c809e40fc932aaaf644ebdcbb40e SHA-1: c4846e1712b22119b4b64e43606b5bd1c13da76c SHA-256: bd71daad924fec5534bfad5da0c17aec35bfe86b15de2e9468b01bf4f6b39b64

176 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file was flagged by multiple high-severity heuristics, including ML classification and ClamAV detection, indicating malicious intent. It contains an embedded URL that redirects to a suspicious domain, likely serving as a lure for phishing or malware download. The heuristic 'SE_CLIPBOARD_COMMAND_LURE' suggests the document may also instruct the user to execute commands, further increasing the risk.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xezojetit.ru/strik?utm_term=how+to+fix+gas+oven+that+won%2527t+heat+up PDF link annotation
- https://cdn-cms.f-static.net/uploads/4447450/normal_6031ade3b2f10.pdfIn PDF document text
- http://iglivesupportteam.com/parallel_circuits_worksheetkj0ig.pdfIn PDF document text
- http://1fps.ru/how_do_i_reset_my_linksys_range_extender5si5x.pdfIn PDF document text
- http://kostlike.site/338110236022lh7i.pdfIn PDF document text
- http://myluckybet.xyz/concordancia_strong_espaol_e-swordu0pee.pdfIn PDF document text
- http://bitcoins-profits.com/sefipifofenoles2qnje.pdfIn PDF document text
- http://repair-planshetov.ru/nadiradedatuborc0vq0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4456685/normal_601d6a3c3a2d0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/55363abb-0016-4ae0-8618-d62e13fe03e5/feminist_theory_from_margin_to_center_1984.pdfIn PDF document text
- https://s3.amazonaws.com/xuzakob/10417816900.pdfIn PDF document text
- https://s3.amazonaws.com/lazolu/wizumufogibixarujiba.pdfIn PDF document text
- https://s3.amazonaws.com/dojivewobasuval/riwek.pdfIn PDF document text
- https://s3.amazonaws.com/feborobegibew/fundamental_analysis_for_dummies_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f6197477-42ec-423c-9de2-e75317f7a2e6/navy_pilot_training_aircraft.pdfIn PDF document text
- https://s3.amazonaws.com/pevarijidasalop/50705910016.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ca6c0e4c-cd6c-468b-a8f5-71c4d00de687/93481959481.pdfIn PDF document text
- https://s3.amazonaws.com/bupijila/87392634568.pdfIn PDF document text
- https://s3.amazonaws.com/wibedubosateg/disawawaxav.pdfIn PDF document text
- https://s3.amazonaws.com/wetowuzuxit/cant_dead_by_daylight_ps4.pdfIn PDF document text
- https://s3.amazonaws.com/memexelu/why_did_usps_return_to_sender.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eef6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEEF6	5252 bytes
SHA-256: `d3ce16a60bed68cadbcf12ae32339e2ec742caae58034b6b7be4c835d036fe82`
`font_01_sfnt_off00010100.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10100	10856 bytes
SHA-256: `7aa03d5484fbce906f60f84fe6ef881736f3f663e4dae83fce25b72d6a591d61`
`font_02_sfnt_off00012676.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12676	16204 bytes
SHA-256: `a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd`

Open this report in the interactive analyzer, or submit your own file for analysis.