PDF malware analysis — malicious · ed759f38c31293f0

MALICIOUS

PDF

154.0 KB Created: 2021-03-14 20:08:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23

MD5: 884bf279901663eb774b8126fdda6b8f SHA-1: e336d6e4f0eb3d4c2ed76b84b921ae12b633374c SHA-256: ed759f38c31293f09ffd0fcdb0d15a24a5f9fb11765288f1120ac5804d59217f

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a malicious domain, likely for phishing or malware distribution. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is part of a link farm on disposable hosting, further suggesting malicious intent. The ML classifier and ClamAV detection strongly indicate this PDF is malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9977

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/strik?utm_term=tokyo+ghoul+kaneki+pfp PDF link annotation
- https://cdn.sqhk.co/juselivo/dqibhhU/99204217037.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4394077/normal_6021cd7b1804f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412767/normal_604b4d7cb1fa3.pdfIn PDF document text
- https://wabelurotetef.weebly.com/uploads/1/3/4/6/134693048/zawuset.pdfIn PDF document text
- https://cdn.sqhk.co/pumibavi/OJjcjfz/skins_on_netflix_season_12.pdfIn PDF document text
- https://pifisurap.weebly.com/uploads/1/3/4/1/134108900/cacef05.pdfIn PDF document text
- https://sowidokobixu.weebly.com/uploads/1/3/1/8/131856306/guvinusavusaw_pawufaxe_tiliwe.pdfIn PDF document text
- https://gabejopow.weebly.com/uploads/1/3/4/5/134597712/0e823906820.pdfIn PDF document text
- https://cdn.sqhk.co/lazimafuxuxi/ifflMgc/esl_cs_go_player_rankings.pdfIn PDF document text
- https://wujipiledulom.weebly.com/uploads/1/3/4/6/134695719/606750.pdfIn PDF document text
- https://cdn.sqhk.co/felegabiw/pk9hh5X/my_sweet_bakery_donut_shop.pdfIn PDF document text
- https://noremovex.weebly.com/uploads/1/3/4/8/134883944/mabawutatu-pafozuditi-gaweximefasug-xujadatepiwiw.pdfIn PDF document text
- https://wisetigu.weebly.com/uploads/1/3/4/3/134357320/97e643.pdfIn PDF document text
- https://cdn.sqhk.co/navuwamas/C0gjDBG/81303650165.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4414678/normal_5ff56715c2379.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/petubapizo/jixeredimane.pdfIn PDF document text
- https://s3.amazonaws.com/kujapomib/sand_blasting_machine_design.pdfIn PDF document text
- https://8607b5f8-c2b2-49b7-a314-b17bd4efff40.filesusr.com/ugd/d99252_0603066f416b47ba878e10ac13ff5ec9.pdf?index=trueIn PDF document text
- https://19e6fc83-c281-4d06-93fd-e8b16a02b90a.filesusr.com/ugd/ce5d00_338b1b5e36a044ab99a715b33fe6b70c.pdf?index=trueIn PDF document text
- https://b998fa74-583e-446a-a2a7-67f41460fdb2.filesusr.com/ugd/e081f8_9292c5df40be4ebca88dd7bf182fb68b.pdf?index=trueIn PDF document text
- https://81da36f4-dec6-4bf4-836b-19ed67500659.filesusr.com/ugd/5fd5c1_d66549c0f6454164ae326219210beeb4.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/falevi/malice_mizer_merveilles_album.pdfIn PDF document text
- https://s3.amazonaws.com/lomiwexuva/97505742533.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00020874.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x20874	7192 bytes
SHA-256: `fed6eca8f108e331ebdcc8eadf53b87ff5ccca2832683c05b79637ad79612fd7`
`font_01_sfnt_off000220dc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x220DC	5004 bytes
SHA-256: `ec3168c4c9a6031bb4ecd7409a4c21edd45595c773ab7532387a059c99041823`
`font_02_sfnt_off000231f9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x231F9	12008 bytes
SHA-256: `8be45973496ba807c61a1a012e442bf2afdcd0863b122785ac6c874ae2576e40`

Open this report in the interactive analyzer, or submit your own file for analysis.