PDF malware analysis — malicious · c56b22508f91196a

MALICIOUS

PDF

83.7 KB Created: 2021-03-20 19:13:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 31e1f13d75fa35817361492474227a37 SHA-1: b00b744f6e6b6ab147a65bd8ecc790c1b8e63e82 SHA-256: c56b22508f91196a3064d0758b2cca00387df9332a7385e69edb221c2ecc06ec

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The document contains numerous embedded URLs pointing to a link farm hosted on disposable domains, suggesting a phishing or malware distribution campaign. The presence of PDF-specific heuristics like 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_URI' strongly indicates a malicious intent to redirect users to external, potentially harmful content.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xajibur.ru/123?utm_term=video+er+for+instagram+story PDF link annotation
- https://cdn-cms.f-static.net/uploads/4404753/normal_5fd77945e2f35.pdfIn PDF document text
- http://tonukavugu.mygamesonline.org/jurassic_park_book.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4457563/normal_6040be29c870d.pdfIn PDF document text
- http://prosale.company/what_is_the_message_of_the_poem_remainshitlv.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381532/normal_603e29302c062.pdfIn PDF document text
- http://potolkilife.ru/10111896637jyilc.pdfIn PDF document text
- http://filanion.online/book_report_outline_9th_gradea5jee.pdfIn PDF document text
- http://kubosikavudux.mygamesonline.org/91460711996.pdfIn PDF document text
- http://trysucre.pro/860831468807qul7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/lorifawuvawot/8644222693.pdfIn PDF document text
- https://ec8c99fd-5413-4e38-b6a0-2ccbba71fc6f.filesusr.com/ugd/de02f3_a597ff1b0c9f45898eed07cfbb5f2c7d.pdf?index=trueIn PDF document text
- http://zaxuzut.atwebpages.com/tufezosexijijigimivomub.pdfIn PDF document text
- https://2571d5ef-7130-409a-b87d-c3fd18a83f30.filesusr.com/ugd/71fc55_5f58a8c4a3bc4942b2dc2361968f644b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/bofake/euripides_bacchae_analysis.pdfIn PDF document text
- https://da89e6ec-52f9-4c28-8de8-447a2e923c0c.filesusr.com/ugd/5e5b2a_55ea2d1c30a34eb6a73f613bd40f0fcf.pdf?index=trueIn PDF document text
- https://15e12281-0fef-4bb1-b284-2b61ddec1698.filesusr.com/ugd/6c5390_4266c4c19182472ba4940e0dbad84874.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/davolazupivowi/collision_reporting_centre_burlington_on.pdfIn PDF document text
- http://nuwadolonopip.onlinewebshop.net/best_dance_songs_70s_80s_90s.pdfIn PDF document text
- https://f05e0dbb-21cf-40ea-8b71-00b8d6f49a3b.filesusr.com/ugd/b09e1d_930475bac029409e94c653b2763ad511.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/desekusoxi/17087260015.pdfIn PDF document text
- https://737bf953-b780-43bc-8af0-312ed5328a40.filesusr.com/ugd/017c44_bc06637f482a403f9a9f46317b44c708.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f996.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF996	5052 bytes
SHA-256: `b66f1e8e7441e55d2c076df24a9825d541d8c14f56a9fb7c7be16a6e983ca913`
`font_01_sfnt_off00010ab1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10AB1	11472 bytes
SHA-256: `4d78306d57c749f55f58df079be65bd8a9152d38e51d2fcc74dc33e6ec9c0dfc`
`font_02_sfnt_off000131ad.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x131AD	4324 bytes
SHA-256: `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`

Open this report in the interactive analyzer, or submit your own file for analysis.