PDF malware analysis — malicious · d7bced0c80030189

MALICIOUS

PDF

85.5 KB Created: 2021-03-25 09:12:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12

MD5: d050b77b25edaf2d7721d12df06bea81 SHA-1: 35e17dde28d6e9cd9c4cfe7ab42e746fbe9e4108 SHA-256: d7bced0c800301890250fde8c41b07b80b8d1a74fa89fe71290dc6b63d50adbf

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The document body references popular media like 'Baahubali 2 dublado mega', likely as a lure to disguise embedded malicious links. The presence of numerous external URIs, many pointing to disposable hosting or link farms, further supports a phishing or malware distribution scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://maypoin.ru/123?utm_term=baahubali+2+dublado++mega PDF link annotation
- https://nobewiga.weebly.com/uploads/1/3/5/3/135315034/7417883.pdfIn PDF document text
- https://zokelafeg.weebly.com/uploads/1/3/4/8/134889419/dunetutanaze_muxuf_vukovapuj_naxen.pdfIn PDF document text
- https://cdn.sqhk.co/zarejesorufo/Yojaie9/hippety_hopper_1949.pdfIn PDF document text
- https://cdn.sqhk.co/dubikureta/cQqjiaA/mexedowe.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4449178/normal_603fb9660937a.pdfIn PDF document text
- https://cdn.sqhk.co/wimebizag/hL0iaif/commoncoresheets_rounding_decimals.pdfIn PDF document text
- https://kekuxepepave.weebly.com/uploads/1/3/0/7/130739312/e7e1504d64.pdfIn PDF document text
- https://cdn.sqhk.co/jeporikate/0hgRjaF/95665323091.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4380691/normal_5ff57c6c23c59.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4403805/normal_6009010292ea1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4476939/normal_600ec09a99334.pdfIn PDF document text
- https://vataripisak.weebly.com/uploads/1/3/4/6/134600115/8393517.pdfIn PDF document text
- https://xumizobizuzu.weebly.com/uploads/1/3/4/6/134688834/4722006.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412165/normal_6040115e1c4e4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- https://uploads.strikinglycdn.com/files/7f4e1b40-9a39-4eab-83c9-186091301fab/el_negocio_del_siglo_21_libro_completo.pdfIn PDF document text
- http://saxodanokijaj.atwebpages.com/vinonoxurorajanedida.pdfIn PDF document text
- https://s3.amazonaws.com/rimejiguvif/ccsk_certification_study_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e7380af9-f68b-4b67-9702-061e04bac39e/32833464190.pdfIn PDF document text
- http://duribolatajofa.atwebpages.com/54189731913.pdfIn PDF document text
- https://s3.amazonaws.com/fifuto/bawli_tared_video_song_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8db2a8c8-a2d8-4655-8812-f10c4b7ee46f/sapadoje.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e6d5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE6D5	5288 bytes
SHA-256: `6230279e5e1b499df5149ed92639121cfbdd140aaf4f2de2db9e559e42c1cf06`
`font_01_sfnt_off0000f8a8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF8A8	4284 bytes
SHA-256: `54950d7e65873c291db71ea3fcb055c0b4918e2f9fe329d4afdc5addd1405b0e`
`font_02_sfnt_off000108ba.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x108BA	13016 bytes
SHA-256: `d554ab6d89a8acf39da1ddd1b2d6cdbb87c86eb5249889c12e713f521383b24c`
`font_03_sfnt_off00013162.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13162	16192 bytes
SHA-256: `9c7926b8929b88a1dffb52ec04bcfb477868fd459509337312ce674bafabbb6a`

Open this report in the interactive analyzer, or submit your own file for analysis.