PDF malware analysis — malicious · e30e384f108ad6f8

MALICIOUS

PDF

72.5 KB Created: 2021-09-21 21:36:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: 390ea8d7e7f71eb4408dde35574a961b SHA-1: c03d5f024d0c1687da7a88748ed5327132d17192 SHA-256: e30e384f108ad6f8526102f7fa2627589d2d8699ba914b8703747e62fcc2cd63

146 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The presence of numerous external URIs and the 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristic indicate a strong likelihood of this document being used for phishing or to redirect users to malicious sites. The ML classifier also strongly supported a malicious verdict.

Machine Learning

Nyx PDF Classifier malicious score 0.9973

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
QR-code redirect lure medium SE_QR_LURE

Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ketchas.ru/uplcv?utm_term=ios+contacts+to+android PDF link annotation
- http://werder-ritter.de/UserFiles/File/mazilikoditinefibez.pdfIn PDF document text
- http://zakuskymoser.cz/www/ckfinder/userfiles/files/posajamawi.pdfIn PDF document text
- http://ucg-eg.com/userfiles/file/86925281882.pdfIn PDF document text
- https://personalloan2u.com/wp-content/plugins/super-forms/uploads/php/files/503cdf415f5d39277528a316f29eb7a2/xewuwe.pdfIn PDF document text
- http://abnigakgdsg.friendship-match.com/upload/files/5824124568.pdfIn PDF document text
- http://dynamicyunnan.com/ckfinder/userfiles/files/12894689795.pdfIn PDF document text
- http://clinicaveterinariaalbese.eu/userfiles/files/62540007183.pdfIn PDF document text
- https://rajaunited.com/contents/files/gokijoxejiril.pdfIn PDF document text
- http://indianmailbox.com/assets/images/userfiles/files/forosupopipe.pdfIn PDF document text
- http://levant-tekstil.com/other_files/File/23262835580.pdfIn PDF document text
- http://vesimport.ru/userfiles/file/kovorokizarup.pdfIn PDF document text
- http://frankifoto.com/uploads/pages/files/votetilizefosurojetojalun.pdfIn PDF document text
- http://jjc-dev.com/userfiles/file/waxeviguwo.pdfIn PDF document text
- https://eastmangroupllc.net/ckfinder/userfiles/files/vozezaxiwevawumomo.pdfIn PDF document text
- http://alrabbancapital.com/file/files/86957727657.pdfIn PDF document text
- http://veitali.com/upload/files/41534009797.pdfIn PDF document text
- http://basyapiemlak.com/yukleme_klasoru/userfiles/file/wexukinitow.pdfIn PDF document text
- https://hacunamatata.ru/wp-content/plugins/super-forms/uploads/php/files/65613add6c1f93d774673db70160b953/2460326080.pdfIn PDF document text
- http://salt17.com/userfiles/files/7789086875.pdfIn PDF document text
- http://owv-sad.de/userfiles/files/nawubukedafavunum.pdfIn PDF document text
- http://www.parkwaytransplant.com/media_upload/upload/files/22350840732.pdfIn PDF document text
- http://www.motionmantra.com/userfiles/files/18219129014.pdfIn PDF document text
- https://yasacompany.com/upload/files/xiloxegoxaxizip.pdfIn PDF document text
- https://odontologosmalca.com/images/userfiles/file/25885457019.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bcf5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBCF5	10136 bytes
SHA-256: `a97426defe7aa9e230ce71c9eebd72d041b1698e209f42432852f6738a1a3166`
`font_01_sfnt_off0000d3b4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD3B4	15864 bytes
SHA-256: `6ade7404956ac8cd2e86e3044cbb3e1f0ebb88cd6d2629e355a95e46ac1503a3`
`font_02_sfnt_off0000fc2b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFC2B	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.