PDF malware analysis — malicious · bdcb7aa1956ab1ef

MALICIOUS

PDF

277.3 KB Created: 2021-05-04 15:10:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22

MD5: 7f7214691fc12f6010d58282162db671 SHA-1: daf4877016d2bbc17c2ffaf621b192c4d92503b2 SHA-256: bdcb7aa1956ab1ef675e6576f2d6f39295d154ab6b150e2149e1acb740fe25ad

194 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains heuristics indicating it is a malicious redirector and an advance-fee scam lure, typical of phishing campaigns. The embedded URL points to a known malicious redirector infrastructure. While no scripts were explicitly extracted, the PDF structure and malicious link suggest an attempt to redirect the user to a phishing or malware distribution site, likely initiated via spearphishing.

Machine Learning

Nyx PDF Classifier malicious score 0.9949

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE

Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/strik?utm_term=how+much+do+digital+marketers+earn+in+canada In PDF document text
- http://wigosixozem.mywebcommunity.org/25147184062.pdfIn PDF document text
- http://lajodibibodi.getenjoyment.net/ngo_financial_report.pdfIn PDF document text
- http://wutopezogegusi.getenjoyment.net/80062487970.pdfIn PDF document text
- http://zegererevez.medianewsonline.com/jurnal_cfit.pdfIn PDF document text
- http://mesanezedid.mypressonline.com/quran_taj_company.pdfIn PDF document text
- http://sokobumoxagug.scienceontheweb.net/tumikuku.pdfIn PDF document text
- http://diporesorojina.scienceontheweb.net/grounded_theory_definition_glaser_and_strauss.pdfIn PDF document text
- http://kavelokafozi.medianewsonline.com/fumeki.pdfIn PDF document text
- http://larekew.mywebcommunity.org/baburnama_thackston.pdfIn PDF document text
- http://tevutubiwij.getenjoyment.net/cards_against_humanity_cards.pdfIn PDF document text
- http://sipataj.sportsontheweb.net/belexizegetujizumodas.pdfIn PDF document text
- http://miromawetibikew.mywebcommunity.org/jowunivozewazatabi.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/7ef1ef84-6c0a-4677-b3d4-39b8373d0222/qu_es_un_aforismo_y_5_ejemplos.pdfIn PDF document text
- http://vilepobafomunow.atwebpages.com/albert_ayler_on_green_dolphin_street_lyrics.pdfIn PDF document text
- https://c140f178-ee45-427e-91fe-a3c5f821f67e.filesusr.com/ugd/ebc5f9_ccd1dd62556d43eb9a279b5f1548ef4b.pdf?index=trueIn PDF document text
- https://cad90261-f038-4e8a-b384-2e0e37e6cb8c.filesusr.com/ugd/4c4e45_74a3afd9aa284ecb9dbd727ab363845d.pdf?index=trueIn PDF document text
- http://pawepeg.atwebpages.com/cbse_class_9_syllabus_2020_20_download.pdfIn PDF document text
- http://bumejefivoxigo.myartsonline.com/xinepevasutu.pdfIn PDF document text
- https://13a7c488-548c-4b48-b567-d2b0b9a3e1de.filesusr.com/ugd/85d67f_2970896e952646ee81488b98fe50e9e6.pdf?index=trueIn PDF document text
- https://2061f665-9309-41a6-981d-137229ee7e60.filesusr.com/ugd/eb2fe6_1fef4a6fbb474047897bb1886b904d44.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f1d193cc-a999-4000-b36d-22a58616ed94/ue_boom_2_charger_specs.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0003f352.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3F352	5468 bytes
SHA-256: `dad63c19694c9f2c0a31c209724f65a2fca6b7900012957591b31c6f87acdadf`
`font_01_sfnt_off000405d1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x405D1	13828 bytes
SHA-256: `cad527208a588180404b8004c726467b7c7e5b6a347aade0aaf7e29b2673bc93`
`font_02_sfnt_off0004314d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4314D	16168 bytes
SHA-256: `bcfecb9fde4b74e4a2b692e15caf305b2988a1cfe4c6386614002e38d35feb86`

Open this report in the interactive analyzer, or submit your own file for analysis.