PDF malware analysis — malicious · e17fc5dc061d1f6a

MALICIOUS

PDF

88.2 KB Created: 2021-03-27 17:45:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23

MD5: 44fd37954fac19c7ab697bde44a72599 SHA-1: f53c85c75098d47e036911fbd64039e12ae47542 SHA-256: e17fc5dc061d1f6a37b3906f0687ffb2eade9bb8311280bce36a2107ecca5efa

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, many pointing to disposable domains or link farms, suggesting a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains references to 'Aprender alfabeto coreano pdf', indicating a lure to attract users to potentially malicious external sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9989

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/award?keyword=aprender+alfabeto+coreano+pdf PDF link annotation
- https://cdn.sqhk.co/tiwoxebu/b0Trjjm/govaxadi.pdfIn PDF document text
- https://cdn.sqhk.co/jukunobegabe/hi51igf/monkey_bread_with_cinnamon_rolls.pdfIn PDF document text
- http://deteluwo.iblogger.org/rebel_music_daniel_felsenfeld.pdfIn PDF document text
- https://cdn.sqhk.co/mirofifuba/jk4yjfD/63784226369.pdfIn PDF document text
- http://digozulujatozuj.iblogger.org/tifalopamusoreligosadapow.pdfIn PDF document text
- http://rorafosuwis.22web.org/lofomavobusovuson.pdfIn PDF document text
- https://cdn.sqhk.co/fajoliteve/OjeZzuO/bendreff_recharge_program.pdfIn PDF document text
- https://cdn.sqhk.co/bisadidizi/e81XZge/logo_quiz_game_level_4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://dudotofuzariw.rf.gd/binding_entry_xamarin_forms.pdfIn PDF document text
- https://s3.amazonaws.com/naxozelozude/letter_names_and_sounds_worksheets.pdfIn PDF document text
- https://73099f28-10d5-4558-98a1-2f8dc61f1a2f.filesusr.com/ugd/f62eaa_855fc7aa4e7c41b7b95944794e204296.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fedure/potonokevaximixomilese.pdfIn PDF document text
- http://litaludoxuba.epizy.com/xujilalinomiranisitamur.pdfIn PDF document text
- https://4edd92ed-4e96-4c3d-a837-a16c7246ae9e.filesusr.com/ugd/7c3149_c3c2b29379ec47ab8aaeb2e85cc817cc.pdf?index=trueIn PDF document text
- https://2df7536a-ab64-4dd3-a6ca-98e0eca144a4.filesusr.com/ugd/de578f_9cc98e67e1244e06b4c24d50682ca2c7.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/bagisi/pobesudoboma.pdfIn PDF document text
- http://zabirozoxut.epizy.com/books_to_read_while_pregnant_for_the_baby.pdfIn PDF document text
- http://pubamawuxa.epizy.com/amor_liquido_bauman_download.pdfIn PDF document text
- http://pomigipasa.epizy.com/64421552291.pdfIn PDF document text
- https://s3.amazonaws.com/jamuluvuvava/foliage_report_2019_maine.pdfIn PDF document text
- https://4ac36a2f-1533-488b-b282-cf34cdace458.filesusr.com/ugd/bcfc12_ef01f779265e4c6ab7d51dd1178b82ef.pdf?index=trueIn PDF document text
- https://3cde87c3-25ab-478b-b58d-ba072f1c7540.filesusr.com/ugd/255d97_4571ebd810a54f0799d90c6da65d6eb8.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/titugome/nexodovaxod.pdfIn PDF document text
- https://s3.amazonaws.com/jezobasit/motorola_g6_quick_start_guide.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f16a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF16A	10720 bytes
SHA-256: `a1b3c7996cb33e8bd850639ee3003d5f9bf0e31cae53e86e57b5e487507b38e7`
`font_01_sfnt_off00011476.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11476	5100 bytes
SHA-256: `2acba59da8aed5216df80029ed8457b70d48fa5e871d010071363e370183637e`
`font_02_sfnt_off000125de.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x125DE	14612 bytes
SHA-256: `c52dfb254a8661527d2ff81eee8b2ba92e017054228bd10c4480ca9787a2be1d`

Open this report in the interactive analyzer, or submit your own file for analysis.