Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a6fbed5a63e056b…

MALICIOUS

PDF

63.5 KB Created: 2021-10-02 16:12:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23
MD5: f079c5b112c40758530cf500828f002d SHA-1: 9b6b74e35e8c5619a3aa423baec1ed456d78ae5f SHA-256: 0a6fbed5a63e056b76bcf815f79d7e7ad8176eeefe0615ebf372a55ee2d36766
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The presence of numerous embedded URLs, many pointing to disposable hosting and utilizing UTM parameters, strongly suggests a phishing or malware distribution campaign. Although no scripts were explicitly extracted, the PDF structure and URL patterns are consistent with techniques used to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7092

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=damped+and+undamped+system PDF link annotation
    • https://cottingham-group.com/cufiles/files/60352299804.pdfIn PDF document text
    • http://pietrek.com/MARCUS/files/file/wawizegadale.pdfIn PDF document text
    • http://chistogood.ru/admin/ckfinder/userfiles/files/sorazupiwinimagiz.pdfIn PDF document text
    • http://www.europesolidaire.eu/userfiles/files/tegenukodowulasosi.pdfIn PDF document text
    • http://pegasomeeting.medcoast.net/ckfinder/userfiles/files/36080088491.pdfIn PDF document text
    • http://yeosingol.com/FileData/ckfinder/files/20210903_7E972268FA32CBE9.pdfIn PDF document text
    • http://tinavaron.com/ckfinder/userfiles/files/21413035390.pdfIn PDF document text
    • http://mebizstekla.ru/userfiles/file/ropotarebosusegitoxituga.pdfIn PDF document text
    • https://magatek.com/documents/file/72394614519.pdfIn PDF document text
    • http://multiflex.ru/userfiles/file/50757273566.pdfIn PDF document text
    • http://xn--80aafmoni2biho.xn--p1ai/admin/ckfinder/userfiles/files/vegakoru.pdfIn PDF document text
    • http://tccsrl.org/userfiles/files/zigofixotedarijijizoru.pdfIn PDF document text
    • http://thebeautyofdesign.nl/ckfinder/userfiles/files/50421736574.pdfIn PDF document text
    • https://worldpigment.com/image/upload/File/39142727930.pdfIn PDF document text
    • http://tyros-club.de/userfiles/file/29661908307.pdfIn PDF document text
    • http://kdbelektrotechniek.nl/uploads/file/86588566025.pdfIn PDF document text
    • https://completecollegestrategies.com/wp-content/plugins/super-forms/uploads/php/files/60b69e0eb749d41bb669e482bd194008/38713055368.pdfIn PDF document text
    • http://maha.tcnme.com/chop/multimedia/userfiles/file/josafumimodam.pdfIn PDF document text
    • https://www.domosystem.gr/ckfinder/userfiles/files/40859510786.pdfIn PDF document text
    • https://tiemhoahaibara.com/data/dulieu/files/solifamab.pdfIn PDF document text
    • http://momsystem.ru/public/file/doxoxanagegipuf.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000acac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xACAC 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000c4c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC4C3 10408 bytes
SHA-256: 8fc1d81e4adb46689b5379188cfa270d49cd8a54a247a53bc5734c8539fc08c9

Open this report in the interactive analyzer, or submit your own file for analysis.