PDF malware analysis — malicious · c1bc771a8b4d369b

MALICIOUS

PDF

79.9 KB Created: 2021-09-23 19:05:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26

MD5: ff43d8e502cb9a9d1fa502acd9aaf0f5 SHA-1: c60f1e4bc094f355ecda700ddf0452ba3eb385b7 SHA-256: c1bc771a8b4d369b3c1b216caaff37765f5ace2d1357bbe42fae1cb6930ef54b

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and is flagged as a link farm on disposable hosting, indicating a malicious intent to redirect users. The ML classifier and ClamAV detection strongly support this assessment. The embedded JavaScript likely facilitates the redirection to malicious sites, as suggested by the PDF_URI heuristic.

Machine Learning

Nyx PDF Classifier malicious score 0.9949

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://wastran.ru/uplcv?utm_term=online+movies+mod+apk PDF link annotation
- https://thehamptonsbloomington.com/wp-content/plugins/formcraft/file-upload/server/content/files/16134219445479---24128346518.pdfIn PDF document text
- http://vnationwide.com/userfiles/files/lasotikuxi.pdfIn PDF document text
- https://www.vignolaweb.it/ckfinder/userfiles/files/96054109637.pdfIn PDF document text
- http://cafehinglung.com/uploads/files/9341412344.pdfIn PDF document text
- http://an-ocn.ru/ckfinder/userfiles/files/nazujuvul.pdfIn PDF document text
- http://kesherisrael.com/uploadEditor/files/kofuzatakorezapedu.pdfIn PDF document text
- https://bgg.pirkitpadangas.lt/ckfinder/userfiles/files/37715078754.pdfIn PDF document text
- http://chickendaylacrescenta.com/uploads/files/96494044485.pdfIn PDF document text
- http://laiksmodalux.lt/app/webroot/uploads/userfiles/files/153805653.pdfIn PDF document text
- http://underbutter.cz/download/foto/xorazepajibisaromemuf.pdfIn PDF document text
- https://33mobility.net/uploads/files/41979957271.pdfIn PDF document text
- https://gtnet-engine.com/ckfinder/userfiles/files/52124696424.pdfIn PDF document text
- http://9275522-travel.com/userfiles/file/51881758867.pdfIn PDF document text
- https://taucaotoccatba.vn/images/news/files/60006685571.pdfIn PDF document text
- http://kingkady.com/uploadfile/files/fofadaloxexipuviwo.pdfIn PDF document text
- https://jogamiskolc.hu/ckfinder/userfiles/files/56833235612.pdfIn PDF document text
- https://mmszke.hu/files/file/81806790855.pdfIn PDF document text
- http://burningspearmarketplace.com/js/ckfinder/userfiles/files/mukubusuzezakuzafuloj.pdfIn PDF document text
- https://pieseautocomenzi.ro/userfiles/file/movuzewezizuf.pdfIn PDF document text
- https://jungleflightchiangmai.com/Uploads/files/75882334062.pdfIn PDF document text
- https://betentour.com/sites/default/files/file/82616324433.pdfIn PDF document text
- http://edmo-cars.nl/images/file/zobujekagaruda.pdfIn PDF document text
- https://www.rockandroll.blog.br/wp-content/plugins/super-forms/uploads/php/files/6v6eof2uc47gipitpbakq585vs/16304445107.pdfIn PDF document text
- http://slavutich-media.ru/userfiles/file/taroxoroxomizelijed.pdfIn PDF document text
- https://traicaygiasi.com/Images_upload/files/51188372765.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d61f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD61F	17076 bytes
SHA-256: `42d765c64eb214d5b2e611c15e54829eb91abf173acb1b146b985917cb8363fd`
`font_01_sfnt_off000101f6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x101F6	10536 bytes
SHA-256: `b5dcc8c2a8b5bf450873456471819e3d784acf213df9df763f4168fc4c784de5`
`font_02_sfnt_off000119fa.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x119FA	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.