Malicious PDF — malware analysis report

Static analysis result for SHA-256 29d659eb141a1a55…

MALICIOUS

PDF

52.0 KB Created: 2021-10-01 03:45:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-21
MD5: 1f6e61beb155778983db3af4b1d38c0c SHA-1: 70d79ac717212088bfe52e8fdc536438a18316a9 SHA-256: 29d659eb141a1a558573b614c56d12374c18caf041495a6dcf27120f07976567
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous external URIs and is flagged as a link farm on disposable hosting, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5290

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=decimal+to+binary+to+octal+to+hexadecimal PDF link annotation
    • http://chinastom.ru/userfiles/file/vezemebixefoxarom.pdfIn PDF document text
    • http://synhbio.com/upload/files/vejufiwunozusesupovefab.pdfIn PDF document text
    • http://snabsz.ru/ckfinder/userfiles/files/gosikurorus.pdfIn PDF document text
    • http://parentini.it/userfiles/files/pipixupategifawujefu.pdfIn PDF document text
    • https://braintreeclinics.com/app/webroot/img/files/finawulasagusu.pdfIn PDF document text
    • http://ambiance-cinema.fr/wp-content/plugins/super-forms/uploads/php/files/1d9c674de0daa8cef9ab40d4770fd40e/85777103108.pdfIn PDF document text
    • https://karpataljaturizmus.hu/upload/nuropivijefawuwudorode.pdfIn PDF document text
    • http://elrey-uslugi.ru/media/file/11265409267.pdfIn PDF document text
    • http://mopi.eu/ckfinder/userfiles/files/75339780430.pdfIn PDF document text
    • http://parfumland.sk/upl/bawibanoxaxoluv.pdfIn PDF document text
    • http://evevoyance.fr/adh/.-/file/duvabikalurive.pdfIn PDF document text
    • http://pk.mo/userfiles/file/72769007636.pdfIn PDF document text
    • http://haustechnik-hagenauer.at/zopudifuxumuxirowizix.pdfIn PDF document text
    • http://211.129.1.225/system/ckfinder/userfiles/files/52638549336.pdfPDF link annotation
    • https://xn--pssa17sw71b.tw/upimages/files/81528925130.pdfIn PDF document text
    • http://biosurfest.com/userfiles/files/2101958635.pdfIn PDF document text
    • http://giaydantuongphongngudep.com/images/news/file/70647544810.pdfIn PDF document text
    • http://giaydantuongphongngudep.com/images/news/file/mixevosegu.pdfIn PDF document text
    • https://niboparis.com/upload/fckeditor/file/1630668674_1.pdfIn PDF document text
    • http://abwlondonblvd.com/uploads/files/zazazelijosos.pdfIn PDF document text
    • https://cemb.ca/upload/editor/file/folupukakigu.pdfIn PDF document text
    • https://assignmentmart.com/ckfinder/userfiles/files/tepoxopezisefe.pdfIn PDF document text
    • http://ristoranteyuri2.com/userfiles/file/rexiluzasagovo.pdfIn PDF document text
    • https://saigonservices.vn/images/uploads/files/memipoluwikut.pdfIn PDF document text
    • http://brandnewgoods.net/userfiles/file/76967977728.pdfIn PDF document text
    • https://ph2020.org/ckfinder/userfiles/files/70793783265.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.