Malicious PDF — malware analysis report

Static analysis result for SHA-256 25e53cbb0dd2a0ba…

MALICIOUS

PDF

62.2 KB Created: 2021-09-26 20:00:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: 78622b20b9c137d0283a64c4d3e8b05c SHA-1: fbeda3e8673fbcc2dc8b24cf7a26536207c051e0 SHA-256: 25e53cbb0dd2a0baeaf02ecffb0a4a2500b092a4cd0b7660277effe7949b1b96
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous embedded URLs, many of which are part of a link farm hosted on disposable domains, indicating a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly suggest malicious intent. The file's purpose appears to be redirecting users to potentially harmful external content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5156

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=best+video+watermark+remover+app+for+android PDF link annotation
    • http://muszempilla.com/files/file/vuvinurotaminaminegufur.pdfIn PDF document text
    • http://kingtonkatsu.com/uploads/files/98656894844.pdfIn PDF document text
    • http://garankuccu.com/upload/fckimagesfile/8d0e4a7784c97c7915dc271a0f798a5c.pdfIn PDF document text
    • https://manuscripthandler.com/userfiles/file/68034277692.pdfIn PDF document text
    • https://www.entornopublicitario.com/wp-content/plugins/super-forms/uploads/php/files/51080f37fe3ec48592e2ba98fb3aab5c/sexonivewotin.pdfIn PDF document text
    • http://gerocuki.hu/user/file/zuzuf.pdfIn PDF document text
    • http://meubelenindex.nl/images/uploads/31684519403.pdfIn PDF document text
    • http://psychologadamczak.pl/userfiles/file/faxuwopeje.pdfIn PDF document text
    • http://voyagevietnamlaos.com/hinhanh/file/pubitile.pdfIn PDF document text
    • https://camelcarpet.org/d/files/guneloritidotijiwonamasew.pdfIn PDF document text
    • http://rigassprotes.lv/uploadz/file/bapufifoxojidavigo.pdfIn PDF document text
    • http://alphamarino.kz/images/news/file/tetovebuligibab.pdfIn PDF document text
    • http://spellenindex.nl/images/uploads/15145380590.pdfIn PDF document text
    • https://www.gurgy.net/ckfinder/userfiles/files/65526627764.pdfIn PDF document text
    • http://pyhunlian.com/uploadfile/file/dopubojatota.pdfIn PDF document text
    • https://mediaget.ru/userfiles/files/32158785965.pdfIn PDF document text
    • http://xn--80ackbssfuieecff0e8c.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/d997v7ubfqskf4elfd3a7a0eo6/jadavikewujeturi.pdfIn PDF document text
    • http://cnpair.com/userfiles/file/53511466492.pdfIn PDF document text
    • http://lixupeng.com/uploads/files/mukapedirevivifim.pdfIn PDF document text
    • https://klubkanine.com/home/klub/public_html/ckfinder/userfiles/files/lovobemazovadujiwekani.pdfIn PDF document text
    • http://pileshoppen.dk/userfiles/file/82150380263.pdfIn PDF document text
    • http://kovovyroba-nosniky.cz/UserFiles/File/misoxajadovurusoduxa.pdfIn PDF document text
    • http://emblem4home.com/UserFiles/Member/File/54659266075.pdfIn PDF document text
    • https://salondumariagededijon.com/userfiles/file/44272983251.pdfIn PDF document text
    • http://email-database.info/userfiles/file/72739453480.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b30d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB30D 15548 bytes
SHA-256: c87d8d247fd71763501f75ddce98652b06a2f0a63fa2a9f4b8c770abbaa57167
font_01_sfnt_off0000da3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA3D 10912 bytes
SHA-256: e9fc2b78ff3689222cd23bcf4dbd1299276c04cb3d9972ee55a6a7c78a0a18e1

Open this report in the interactive analyzer, or submit your own file for analysis.