PDF malware analysis — malicious · 17a3831b2d2fd3cb

MALICIOUS

PDF

72.1 KB Created: 2021-10-08 14:45:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24

MD5: 479885a4c7154880ddabeb7f704f2155 SHA-1: 085af89a655847254e1f279f33b7ec582d259208 SHA-256: 17a3831b2d2fd3cb829108a6ae88c75af7499dc36bafa11bd9c413ce730c5cb7

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The ML classifier and ClamAV detection strongly indicate this PDF is malicious. It contains numerous embedded URLs, many of which point to potentially malicious domains, suggesting a phishing or credential harvesting attempt. The PDF structure and the presence of external URIs are consistent with a spearphishing attachment delivery method.

Machine Learning

Nyx PDF Classifier malicious score 0.7217

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://sitycare.com/FCK-UserFiles/files/lujifazatenopi.pdf In PDF document text
- http://yjeverspeed.com/userfiles/file/1690438720.pdfIn PDF document text
- https://pasarantogel2.com/contents/files/tabozewofowonus.pdfIn PDF document text
- https://elitstroycraft.ru/source/file/98037072736.pdfIn PDF document text
- http://escrima-rlp.de/userfiles/file/32595633869.pdfIn PDF document text
- http://noithatdangcap.vn/app/webroot/uploads/files/kulawuvizajajanuwige.pdfIn PDF document text
- http://tjchenxing.com/filespath/files/20210925210149.pdfIn PDF document text
- http://vesimport.ru/userfiles/file/kovorokizarup.pdfIn PDF document text
- http://sake-tori.com/images/library/File/59152527089.pdfIn PDF document text
- http://boki.hu/editor_up/15397289444.pdfIn PDF document text
- http://inruho.ru/ckfinder/userfiles/files/68977455969.pdfIn PDF document text
- http://2sisaccount.com/userfiles/files/jiligobevobunikapidojemis.pdfIn PDF document text
- http://aydinservis.com/ckfinder/userfiles/files/xuterefetezitivuveriwov.pdfIn PDF document text
- https://taksis.lv/taksis/userfiles/file/72943339458.pdfIn PDF document text
- https://mobisteelegypt.net/userfiles/file/50240911182.pdfIn PDF document text
- https://aordonez.com/images/contenidos/files/gilus.pdfIn PDF document text
- http://happyland-nsk.net/ckfinder/userfiles/files/787116324.pdfIn PDF document text
- http://arcadia-fitness.es/userfiles/file/muwewaxibazi.pdfIn PDF document text
- https://www.studioline.ie/ckfinder/userfiles/files/wulasesofolebunekum.pdfIn PDF document text
- http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/1614737f0339ac---kevupasa.pdfIn PDF document text
- http://chothuethietbi.info/img/files/74252109424.pdfIn PDF document text
- https://b2cexpressdemo.com/userfiles/file/86229769174.pdfIn PDF document text
- https://magnettoptan.com/upload/ckfinder/files/kumobuvedelofovin.pdfIn PDF document text
- https://milsagliksen.org/upload/ckfinder/files/wutogifimule.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=first+tier+tribunal+service+chargePDF link annotation
- http://s250801404.onlinehome.fr/img/uploaded/file/fivozen.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c1e1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC1E1	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000d9f8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD9F8	10672 bytes
SHA-256: `ccddf28e01deb0f4ed27c939f9fd00d088398804c68a75538fa5aeececc6ad62`
`font_02_sfnt_off0000f262.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF262	16512 bytes
SHA-256: `c3ac566e06b63d80f3597bc8e108db32034fa46eb4e55e11f4698fe6cace5de6`

Open this report in the interactive analyzer, or submit your own file for analysis.