PDF malware analysis — malicious · e472c1b2c140b25a

MALICIOUS

PDF

80.5 KB Created: 2021-04-03 11:46:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 7f69f1ad3c8e8d563ff1edf9e24675a0 SHA-1: 213acb238c150ee9a3fa447fef17dd49ab4c8b03 SHA-256: e472c1b2c140b25ad0d9c277cfd975b872fb4026cb15d4cf9928e65fceff4607

136 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ML classification and ClamAV, as malicious phishing content. It contains an embedded URL that redirects to a suspicious domain, likely intended to deliver a malicious payload or phish for credentials. The document body, though heavily obfuscated, appears to contain metadata related to the lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gimoguvi.ru/123?utm_term=dr+stone+sheet+street+surgery+windsor PDF link annotation
- https://cdn-cms.f-static.net/uploads/4453329/normal_5fdb3f3e609b4.pdfIn PDF document text
- https://zitakafe.weebly.com/uploads/1/3/4/5/134587302/rotenulerewos_jixutolejazi.pdfIn PDF document text
- https://dorijalasenotom.weebly.com/uploads/1/3/5/3/135327318/eab026.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4483365/normal_60252f6c6c7ca.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4491670/normal_5fe6e4a8a8880.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387242/normal_60334fac00a18.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422390/normal_602f17d9b901e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4501212/normal_60602eae9aa5e.pdfIn PDF document text
- https://pivakezajategag.weebly.com/uploads/1/3/4/6/134605748/jupiwugaw_lafekodun_kabalidonipaxi.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/29d05238-b5d6-4e4e-8056-9566a833019c/how_much_is_ezekiel_elliott_worth.pdfIn PDF document text
- https://c7fb3737-a2fb-4e06-b71d-f78b648bb0a4.filesusr.com/ugd/a9248e_1b8cda7be37d4f08b064519bdd4a66ac.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/c8ca0932-9242-4ad1-9521-a3125a71db7a/2005_honda_accord_v6_transmission_oil_cooler.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2088df33-7e6b-40ae-8d39-a2e63996d572/line_6_pod_xt_live_pro_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eb7857bb-5149-4e4b-bf25-83b52dbbd1f1/list_of_foods_high_in_complex_carbohydrates.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/132680b6-618e-41a3-acb4-ecdca108dbb5/casio_g-shock_ga-100cm-5aer_comouflage.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c918aec2-f73c-45a2-914f-343fc55bd74d/can_you_play_tom_clancys_the_division_offline.pdfIn PDF document text
- https://2df275fc-a8dd-466e-be95-33fe0afe7bed.filesusr.com/ugd/9b6d1e_5b4c4355a4ec4fdfaaa1158d6bd6987e.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3ca587b1-6b12-480f-97e6-1758530ecadc/55398946605.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e7dd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE7DD	5036 bytes
SHA-256: `4eba834e1df94e8f9bc4b84d82d7b3e8423def36a5c3f0b3a4de9d2989f6a8b8`
`font_01_sfnt_off0000f916.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF916	11120 bytes
SHA-256: `dc1e364d092e508d5a4f4ef638763f70906f1914cc5efe20c0255f2efb6f2851`
`font_02_sfnt_off00011f18.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11F18	16264 bytes
SHA-256: `68de6d6b34629de777ab3ab8a9f134c855f305daa617ab346a3ffef9837f5fc7`

Open this report in the interactive analyzer, or submit your own file for analysis.