PDF malware analysis — malicious · ff59ba9403828945

MALICIOUS

PDF

85.2 KB Created: 2021-04-19 14:17:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22

MD5: 27987902a94788076e25f6d80b47e57f SHA-1: f78b5e0fd79fdc23e257fb31dbf4deb4652d0904 SHA-256: ff59ba9403828945aedd269245b7be50287d898245e7e518701fe5b8aa58df29

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain likely used for distributing malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the document is designed as a link farm on disposable hosting, further supporting a phishing or malware distribution intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://soxebez.ru/strik?utm_term=what+allophones+are+called+principal PDF link annotation
- https://bakefakibozig.weebly.com/uploads/1/3/4/6/134678469/vinisedigakare-suwusikumefex-koxemerolenu.pdfIn PDF document text
- http://top-salez.site/telugu_movies_2018_free_mp4_avioe91i.pdfIn PDF document text
- http://irbestate.ru/bitcoin_money_adder_v4.0_2017_activation_code_freeuyuzz.pdfIn PDF document text
- https://jobeluraxofedir.weebly.com/uploads/1/3/4/3/134317239/6ed0af466359.pdfIn PDF document text
- https://rovagurepuj.weebly.com/uploads/1/3/1/8/131856033/4220773.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://68fdcf0a-b1f0-4758-9edf-48d2be6d990b.filesusr.com/ugd/ac51ce_bd9b972cf27f4fb183d38988c4ba17d0.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fajixe/age_of_war_2_cracked_apk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e72b72e0-b170-4b76-b243-d3556209485c/6896845987.pdfIn PDF document text
- https://s3.amazonaws.com/luropi/what_are_norms_and_values.pdfIn PDF document text
- https://68fdcf0a-b1f0-4758-9edf-48d2be6d990b.filesusr.com/ugd/ac51ce_494e2835cfef4122ba0f31c792a85f0e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fedojigudaj/speed_and_agility_drills_for_football.pdfIn PDF document text
- https://288c7b4b-0494-48f6-8ee2-9dd519b96b0a.filesusr.com/ugd/a107db_64cd447a6a614fe3894ef11f9ee5580c.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sowewazulejewi/baby_shark_remix_song.pdfIn PDF document text
- https://932aa67c-856a-4fda-9fc8-fe3f50d4acc2.filesusr.com/ugd/a25eee_23682f4574a948c18d4d8599a4d462fb.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3477953d-76a0-4538-80af-b56ddb746fe4/32812394275.pdfIn PDF document text
- https://1fc3e790-19e1-43b7-bae7-d09a953f51fe.filesusr.com/ugd/2c608b_4fafb86cb8604b1ab94eeaeec4af53de.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/9253a2c3-7462-4405-bda9-586fe57ba076/62064979063.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9b0d7949-ffb2-44e6-8816-21a3bebcfe18/can_you_cancel_planet_fitness_for_free.pdfIn PDF document text
- https://s3.amazonaws.com/palikuvexake/62712316309.pdfIn PDF document text
- https://5e0c4d4d-41f9-428c-9564-b93e7cff6769.filesusr.com/ugd/510691_e77eec6fbbce4d519467cc90cf54cd95.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fb4b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFB4B	4964 bytes
SHA-256: `4c3b3c9a42e480e0032be617a10458110f7d9d51614b7ba1e1cea3de4c6af259`
`font_01_sfnt_off00010c24.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C24	13772 bytes
SHA-256: `81b7ec8f4aae83ff6676f7b885a380f449e64243da96f10955119f37a46eb333`
`font_02_sfnt_off0001391e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1391E	4324 bytes
SHA-256: `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`

Open this report in the interactive analyzer, or submit your own file for analysis.