Malicious PDF — malware analysis report

Static analysis result for SHA-256 119b9154e2e324d7…

MALICIOUS

PDF

73.8 KB Created: 2021-09-14 01:53:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14
MD5: b7ad9e24683d6da19602a4939b428ca4 SHA-1: 4f8d128ca85680cd055489e400880bfbeaec1739 SHA-256: 119b9154e2e324d70d457ddb16631fe55787b1ce2be4d31d1fbbc929712c7fb2
104 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript and multiple external URIs, indicating a malicious intent to redirect users to potentially harmful websites. The ClamAV detection and the heuristic identifying it as a link farm on disposable hosting further support its classification as a phishing or malware distribution attempt. The embedded JavaScript is likely used to facilitate the redirection or exploit vulnerabilities.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4585

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/uplcv?utm_term=igo+nextgen+truck+android PDF link annotation
    • https://www.davinci.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1613aa08e1ab35---beporokukivi.pdfIn PDF document text
    • http://qhchemicalsfeed.com/upload/files/74376352525.pdfIn PDF document text
    • http://findusafranchise.com/files/files/62302233948.pdfIn PDF document text
    • http://icltindia.in/userfiles/file/liluzopi.pdfIn PDF document text
    • http://euromarkcreations.com/new/fck_img/file/vovopiwiwakakufikemesonog.pdfIn PDF document text
    • http://lt101shop.com/userfiles/files/86967692678.pdfIn PDF document text
    • http://hoangminhsaigon.vn/@dmin/js/ckfinder/userfiles/files/30157297608.pdfIn PDF document text
    • http://kancelaria-perfect.pl/app/webroot/media/files/74130506034.pdfIn PDF document text
    • https://austdoorcaocap.com/upload/files/sulilifudoxifosijuw.pdfIn PDF document text
    • http://lamorenj.com/userfiles/file/74910507965.pdfIn PDF document text
    • https://fullhousetourism.com/UploadFiles/file/20210903190136177.pdfIn PDF document text
    • https://silatur.com/js/ckfinder/userfiles/files/90754642598.pdfIn PDF document text
    • http://palmdale.thepokeluau.com/uploads/files/37363731736.pdfIn PDF document text
    • http://madinaboys.com/easydo%20v2.00/files/uploads/70720959029.pdfIn PDF document text
    • http://tcihk.com/userfiles/lopufodolikixemapamoj.pdfIn PDF document text
    • http://chocoenglish.com/_UploadFile/Images/file/kebexi.pdfIn PDF document text
    • https://www.opdrrustukalac.com/wp-content/plugins/formcraft/file-upload/server/content/files/16136b3216a733---92974102540.pdfIn PDF document text
    • http://dtmaso.com/public_html/Imagens/file/fuwasabukidojowa.pdfIn PDF document text
    • http://xn----7sbab1bcaqplb0ccyi9d.xn--p1ai/files/file/komesew.pdfIn PDF document text
    • https://kabelkyaobuv.sk/editor_uploads/files/42307997844.pdfIn PDF document text
    • http://nesemlak.com/test/images/uploads/files/82862210453.pdfIn PDF document text
    • http://xedaptap.net/userfiles/file/zamodowi.pdfIn PDF document text
    • https://www.aukuras.org/ckfinder/userfiles/files/fiwerimovu.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c413.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC413 18720 bytes
SHA-256: fe7a34fdca51e7ad2a236a91a8816906b19cfdeb5512f70dda3848e8440203b7
font_01_sfnt_off0000f494.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF494 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00010cab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CAB 10576 bytes
SHA-256: ff69efebff4da700b3a2a76e4d626b4b140c9f5c8b2f57e67d3cde7babc39fe3

Open this report in the interactive analyzer, or submit your own file for analysis.