PDF malware analysis — malicious · e8e85a4ee57ff0ec

MALICIOUS

PDF

89.8 KB Created: 2021-06-06 00:52:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25

MD5: 49757e522b0f78ee5a54d7d78494819a SHA-1: eda7a0f5c817ad515cc0b200d43fbd4778528d0e SHA-256: e8e85a4ee57ff0ec1396c8127c8980a395029ecc8d2b5230e328dfb1895d404e

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, many of which point to disposable hosting services and are likely part of a link farm designed to obscure the true malicious destination. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggests a phishing or malware distribution intent. The ML classifier and ClamAV detection further confirm the malicious nature of the file, indicating it is likely a phishing trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://krisoc.ru/pbw?utm_term=surface+area+and+volume+of+pyramids+worksheet+answers PDF link annotation
- https://kadeniki.weebly.com/uploads/1/3/4/0/134097858/pofufewokupag.pdfIn PDF document text
- https://ruzuxopamekegi.weebly.com/uploads/1/3/4/7/134748505/rufexozafidibonu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450139/normal_600dfd72107fb.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4390374/normal_60075af21a78d.pdfIn PDF document text
- https://xinefozi.weebly.com/uploads/1/3/0/7/130775465/2122091.pdfIn PDF document text
- https://sasanufodokedu.weebly.com/uploads/1/3/0/9/130969760/fodulod.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4481065/normal_60071384ab69b.pdfIn PDF document text
- https://biwezufum.weebly.com/uploads/1/3/4/8/134872286/zetaweti-bufadotafelib.pdfIn PDF document text
- https://xuviwutub.weebly.com/uploads/1/3/4/6/134697068/1626057.pdfIn PDF document text
- https://rafumozapisiv.weebly.com/uploads/1/3/4/3/134314615/jewepagefexure.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://xalomuzavege.pbworks.com/f/cuanto_tiempo_tarda_el_papel_higienico_en_degradarse.pdfIn PDF document text
- http://sufizilofab.pbworks.com/f/4.pdfIn PDF document text
- http://vowujepojez.pbworks.com/w/file/fetch/144592818/how_to_make_an_employee_departure_announcement.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0a4551f2-1f72-4c1d-89dd-134a5fdf2dad/80777858388.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0cba33bc-4968-432b-abdf-a3ef9c096927/51274323382.pdfIn PDF document text
- http://sizolasipape.pbworks.com/w/file/fetch/144422949/stack_cup_drinking_game_rules.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/15fe1759-ed5a-4adf-8c34-f394fff43166/donorixanesesagoji.pdfIn PDF document text
- http://kuzimotum.pbworks.com/w/file/fetch/144538455/11604028169.pdfIn PDF document text
- http://tozuxexap.pbworks.com/f/himno_nacional_mexicano_letra_original_completo.pdfIn PDF document text
- http://gegoxelaw.pbworks.com/w/file/fetch/144687489/78566158324.pdfIn PDF document text
- http://dipoziw.pbworks.com/f/24212752353.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc44bd4f-900b-4146-9dba-f11b3ddd62e9/24155031161.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000111c6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x111C6	5696 bytes
SHA-256: `43c861b33a01533bbeaaeaae905d4105511b30d817c8bddec50005731122d784`
`font_01_sfnt_off00012512.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12512	11180 bytes
SHA-256: `1f86da0e8123d49e17e88a317dee1495b02020264b9f60a659c7aadc859e4c14`
`font_02_sfnt_off00014b54.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14B54	4324 bytes
SHA-256: `0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333`

Open this report in the interactive analyzer, or submit your own file for analysis.