PDF malware analysis — malicious · f5c7cf3338d43730

MALICIOUS

PDF

55.4 KB Created: 2020-10-27 23:24:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11

MD5: d689ef85748da5fea2887f8e6bf2f9af SHA-1: 70165a410a412b704ee07798988e19f86ff72b55 SHA-256: f5c7cf3338d4373022e9c12f81bcecc177b28ff6b03bc84ddb38dc0ebd1ad8b4

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm and a redirector URL, indicating a phishing or scam attempt. The ML classifier strongly flagged this PDF as malicious. The embedded URL points to a redirector that likely leads to further malicious content or phishing pages.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/pify?keyword=pentek+intellidrive+manual+espa%25C3%25B1ol In PDF document text
- https://besiwalufeg.weebly.com/uploads/1/3/2/6/132696214/d8b4f785f.pdfIn PDF document text
- https://tovozilulu.weebly.com/uploads/1/3/0/8/130873983/zonezagurig.pdfIn PDF document text
- https://kizekusoviwo.weebly.com/uploads/1/3/1/4/131453028/joxufi-nabuba-fumiwi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366309/normal_5f8e8e1e7a10d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366311/normal_5f873fc392b1c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370309/normal_5f8aa68ad491a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365525/normal_5f8726f9b0aff.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381289/normal_5f8c5ba71b15f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/144e7164-9055-41b3-9a18-753ec48e963d/business_intelligence_analytics_and.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6b37a0a3-a5db-4a00-b006-e5dc4fb74d55/lesadafawilolikubakekov.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8987e190-3590-4d0f-98cb-dfcf51ffca2e/89883574117.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d2f8121e-9bfc-4072-899d-26661797ed07/25711086323.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b79d18fd-7254-483a-881c-d751791756a2/27765610661.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9ecbe1b8-4076-4fec-a8f6-f146985747b6/49408319228.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9ab48b29-71b3-466a-b459-f098efbeff3b/90798738356.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0dc4e6a0-bafc-4da7-a22d-07bdff20002d/58388553012.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0308d3dc-1388-49e9-a5b7-fbb0901e255d/zazozilubigositukoxem.pdfIn PDF document text
- https://s3.amazonaws.com/mafavuzenoliki/cengage_chemistry_books_free_download.pdfIn PDF document text
- https://s3.amazonaws.com/fasanag/98727337427.pdfIn PDF document text
- https://s3.amazonaws.com/leguvefu/54163691678.pdfIn PDF document text
- https://s3.amazonaws.com/mubemutolewe/english_grammar_for_dummies_3rd_edition_free_download.pdfIn PDF document text
- https://s3.amazonaws.com/fosagoba/pan_africanist.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f27ec9fb-291c-4d95-a6fc-8bbb5258787b/buzewejuxasuxagunopuj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/57937d08-63e3-459e-ab85-5b4943241cb3/skylanders_imaginators_strategy_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f615f6bf-9a13-4e89-982f-01d70bdc08dc/download_patch_pes_2013_terbaru_2019.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008c96.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8C96	5444 bytes
SHA-256: `9c560f708143c3f7218ef26cd08c0e5a468823727d1f027fc01f596246ae730a`
`font_01_sfnt_off00009eb8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9EB8	2208 bytes
SHA-256: `6d2cbfb26987aa08f0ce850893b14140e6f16262a7736cbdb5b30dc09036ee5c`
`font_02_sfnt_off0000a845.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA845	11000 bytes
SHA-256: `c93b7f86ac9e739656544bdcc14f13cdd71dec7a9715ef8fa1dfe51a00d07a83`

Open this report in the interactive analyzer, or submit your own file for analysis.