PDF malware analysis — malicious · ca8bb11fc10757aa

MALICIOUS

PDF

89.1 KB Created: 2021-03-15 19:46:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: dfe9633c2f8cea2b71117aa58821cb7e SHA-1: 2c7805b62fe0d1bc723a845a3da59abdbea261d1 SHA-256: ca8bb11fc10757aa038fb7d7dd765284b6948c38ba04054f51dc3e2d8a0c5454

136 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ML classification and ClamAV, as malicious phishing content. It contains an external URI and a redirector link pointing to 'fokemale.ru', which is likely used to deliver a malicious payload or redirect to a phishing site. The document body is heavily obfuscated, but the presence of PDF_SEO_UTM_REDIRECTOR_LINK indicates a phishing lure disguised as a free download.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fokemale.ru/strik?utm_term=molecular+biology+of+gene+by+watson+pdf PDF link annotation
- http://saxamem.iblogger.org/chillar_party_movie_bolly4u.pdfIn PDF document text
- https://cdn.sqhk.co/tikikizeveni/h5ycklK/amazon_echo_dot_deal_99p.pdfIn PDF document text
- http://jojalipubawil.22web.org/necrotic_sword_of_doom_guide.pdfIn PDF document text
- http://jetodubiropev.iblogger.org/50214105226.pdfIn PDF document text
- https://cdn.sqhk.co/tizesefetus/jiifXjj/misofoxeremetezom.pdfIn PDF document text
- https://cdn.sqhk.co/bifoligi/7ificw1/3503075208.pdfIn PDF document text
- https://cdn.sqhk.co/pirasemofoge/hbhgbhj/10516472833.pdfIn PDF document text
- http://duzatizej.iblogger.org/wamotuvapugudeliso.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://jilevatawew.epizy.com/frank_edward_can_t_stop_loving_you.pdfIn PDF document text
- https://ececae0b-1312-4a4c-959a-117928b3d478.filesusr.com/ugd/e6721e_3fd75b148b73485682571cf5940b4300.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/51afdf03-fed2-4a8c-86bd-faa8ed610937/root_word_phon_meaning_sound.pdfIn PDF document text
- https://a43ab9c2-5efb-4cee-ac06-b782a0f5e207.filesusr.com/ugd/4826f5_ac91d24ca25f4a33ac63601f1d9854e9.pdf?index=trueIn PDF document text
- https://f516a5e5-1936-4b34-b436-a929b3a34b8d.filesusr.com/ugd/774001_0d6b7aef5a704a9fb635054fb55d5ccc.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zemunomipazikez/14212906585.pdfIn PDF document text
- https://18cb0a1d-3822-48a5-9ca0-56465202bc9b.filesusr.com/ugd/96564c_2a7a1065b2074d9387d92edec6742566.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fajujiju/denaxazemowinapimekarubu.pdfIn PDF document text
- https://s3.amazonaws.com/vapite/22205618154.pdfIn PDF document text
- https://s3.amazonaws.com/xopugup/mawij.pdfIn PDF document text
- https://s3.amazonaws.com/wixatax/63878204832.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b4cef4a-a029-4d0f-b9dc-fe0f0ef3f477/what_is_the_difference_between_relation_and_function.pdfIn PDF document text
- https://s3.amazonaws.com/bepukuba/13681625526.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010695.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10695	5664 bytes
SHA-256: `2cc22d0b568cd0f8e633d350162e0601b2a31d1c946923855cfe580fce7ae5b2`
`font_01_sfnt_off00011a0d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11A0D	11868 bytes
SHA-256: `6222372327df57ccaf601aac129773d8ec6c948d255e8b408e9f9fdbc10c1219`
`font_02_sfnt_off0001418a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1418A	16176 bytes
SHA-256: `8be69302d4e45fe85c9fab78dc6d96cf410d6213fddef079043d254261a79733`

Open this report in the interactive analyzer, or submit your own file for analysis.