PDF malware analysis — malicious · f0b5913d48f24ab0

MALICIOUS

PDF

172.1 KB Created: 2020-10-09 01:04:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13

MD5: d06596a0d0f49ccb9d79177e05305553 SHA-1: fe70007d468f2e7058063af1b5e2c2ad292af397 SHA-256: f0b5913d48f24ab0f78c90b8911e45f90ea8df2b9f20dbffdda5940dd49841bf

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector heuristic. The presence of numerous links to disposable hosting suggests a link farm designed to distribute malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9869

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/strik?keyword=tutorial+global+mapper+16+espa%25C3%25B1ol+pdf In PDF document text
- http://files.stagingbynikki.com/uploads/1/3/0/7/130775640/ziweduvetiwexev.pdfIn PDF document text
- http://files.nopricetagconference.com/uploads/1/3/1/4/131453857/4895404.pdfIn PDF document text
- http://files.heraldrysymbols.com/uploads/1/3/2/6/132696263/didugixokubeputodo.pdfIn PDF document text
- http://files.collegeplanninghelp.net/uploads/1/3/1/4/131454536/1162890.pdfIn PDF document text
- http://xatinis.wolverine-restoration.com/uploads/1/3/1/1/131163635/4093176.pdfIn PDF document text
- http://kubimire.shonscience.com/uploads/1/3/1/4/131453526/judinitorolojun-zesusekuzivavuj.pdfIn PDF document text
- http://files.xitianyang.com/uploads/1/3/1/3/131383478/bobabumixa.pdfIn PDF document text
- http://rakisod.abanakeewellnesscenter.com/uploads/1/3/2/6/132681763/7795569a4c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/266f7ed0-8282-4a0e-b909-6b1caf1c229a/fafidoxapakakowobozuv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b4a98613-4e14-4c29-893d-d59d3721e6f7/siposebevepamumusax.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2e743d2d-ac69-48e1-8936-9697cc2333aa/zisotuzozunuwajijojulo.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0002717a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2717A	5868 bytes
SHA-256: `3e71fc7cd87ca05a9ad3e9e3e039a55e8a2f13900114ef67a595061452dc38f5`
`font_01_sfnt_off0002851f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2851F	14992 bytes
SHA-256: `58755c8b25e8be7897a925a7a6433ec5d4eb8d5796922805c9c919ab5305bfcf`

Open this report in the interactive analyzer, or submit your own file for analysis.