PDF malware analysis — malicious · f1b99646ed083a32

MALICIOUS

PDF

84.9 KB Created: 2021-09-22 09:11:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: ae5a75a849a172c14a19337c72439804 SHA-1: da53c24e5dab5f72fbd0304b771bad19f0befadd SHA-256: f1b99646ed083a3226d215074b06b9aae27d42861f28ba9f8ee4ee7eb4a521d1

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains embedded JavaScript and numerous external URIs pointing to potentially malicious domains, suggesting it's used to redirect users to harmful content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' further suggests a tactic of using numerous disposable domains to host malicious files.

Machine Learning

Nyx PDF Classifier malicious score 0.9974

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://synerhu.ru/uplcv?utm_term=the+book+thief+pdf+free PDF link annotation
- http://rorolaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/fulofamesepasesemoniv.pdfIn PDF document text
- https://network-italia.it/file/70516036597.pdfIn PDF document text
- https://www.bluegreenshouseboats.in/wp-content/plugins/formcraft/file-upload/server/content/files/1614ac8f2dde20---fixarasebuzuwutebofelokas.pdfIn PDF document text
- https://kamionosnyelvlecke.hu/userfiles/file/dopiguxavu.pdfIn PDF document text
- http://atek-ent.com/upload/file/98072282210.pdfIn PDF document text
- http://pate4me.com/userfiles/file/67639474608.pdfIn PDF document text
- http://kraemer-duennebacke.de/files/file/ragaletegesunobulabon.pdfIn PDF document text
- https://lisacutler.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613aac38231e1---gibimifovuz.pdfIn PDF document text
- https://hinaweb.com/upload/file/gufekewiviromivutufil.pdfIn PDF document text
- http://nandishoverseas.com/UserFiles/File/sekesolafemo.pdfIn PDF document text
- https://mallncart.com/userfiles/files/birenired.pdfIn PDF document text
- https://tramhuonghanoi.vn/upload/files/20211578143.pdfIn PDF document text
- http://aqs-group.it/userfiles/files/tixugugu.pdfIn PDF document text
- http://oldadmin.k12cart.com/media/files/lujosuponis.pdfIn PDF document text
- http://www.eau-msu.ru/ckfinder/userfiles/files/wazopozawobefesekimor.pdfIn PDF document text
- https://houstoncoinshow.org/FCKeditor/file/gejamazolefivanit.pdfIn PDF document text
- http://daisin1977.com/js/upload/files/vovokete.pdfIn PDF document text
- https://isitekmuhendislik.com/userfiles/file/22494768831.pdfIn PDF document text
- http://thelonerangerfanclub.com/ckfinder/userfiles/files/nisaxe.pdfIn PDF document text
- http://alsace.annuaire-regional.com/ckfinder/userfiles/files/70779988479.pdfIn PDF document text
- https://e-motorcycle.tw/upload/emotorcycle/files/38238817222.pdfIn PDF document text
- http://colorfusion.us/admin/images/file/zafolamusefo.pdfIn PDF document text
- http://tk-weld.com/images/library/File/navavonixikeditimugaba.pdfIn PDF document text
- https://netpage.info/userfiles/file/sarutijafuz.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e4f1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE4F1	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000fd03.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD03	18944 bytes
SHA-256: `7e99a99fad22f2b38559d2a53a3567473cbeceb4f5467711d76eba60f692843b`
`font_02_sfnt_off00012ecb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12ECB	10312 bytes
SHA-256: `113ea5500922243ae0a8ca335bb5129ec333a43411ba4a456b34f3b659349c2a`

Open this report in the interactive analyzer, or submit your own file for analysis.