Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f43fb220b7d65f8…

MALICIOUS

PDF

64.2 KB Created: 2021-09-19 23:59:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: bfed4169d9d6a9615fe969321b9104a6 SHA-1: a07b32fad47ebe018c214c4824c6a16f33882bc1 SHA-256: 2f43fb220b7d65f82096da846813abdc8b195794389bc5704230bad41ea66fd8
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous external links, many pointing to disposable domains, which is characteristic of a link farm used to distribute malicious content or conduct phishing. The ClamAV detection 'Pdf.Phishing.Trojan' further supports a malicious intent. While no scripts were explicitly extracted, the PDF structure and heuristic firings suggest it's designed to lure users to external, potentially harmful, resources.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4667

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=rosa+parks+medal+of+honor
    • https://uleshuzataruhaz.hu/files/file/90961655157.pdf
    • http://argyleliquidations.com/userfiles/files/dekotobog.pdf
    • https://glosunspa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613ac4e72615e---5372123155.pdf
    • https://www.q-jin.ne.jp/ckfinder/userfiles/files/90254611341.pdf
    • https://remini.hu/userfiles/file/69809247681.pdf
    • https://newfrio.com/userfiles/files/96322334620.pdf
    • http://huspanda.com/data/ckfinder/files/baxazarakuxodezapigirate.pdf
    • http://ambulatorioveterinariopisillibertozzi.eu/userfiles/files/95097181985.pdf
    • https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/gs1idp7pcj9ncprpom692qrilm/10255647321.pdf
    • http://fiumaradelsossio.it/userfiles/files/lukaf.pdf
    • http://tupnate.com/ckfinder/userfiles/files/99266730889.pdf
    • https://khmernative-rice.com/userfiles/file/12370174468.pdf
    • http://carbontuning.ru/file/xubogelak.pdf
    • http://maxidmum.com/images/upload/fck/file/govebetupubi.pdf
    • https://rybczewice.pl/userfiles/file/16143523780.pdf
    • http://jplus-ag.com/upload/files/BodyFile__6146A38A84146.pdf
    • https://bilalyapidekorasyon.com/userfiles/file/kajevalenekapisixizo.pdf
    • https://akilanews.com/ckfinder/userfiles/files/xixomexaxeloni.pdf
    • http://mateuszkucharski.pl/admin/file/vavonapibajiranus.pdf
    • https://billionbosses.com/ckfinder/userfiles/files/38566240507.pdf
    • http://ecolservizinettuno.com/userfiles/files/panodaxemido.pdf
    • https://collinite.pl/userfiles/file/28453622098.pdf
    • http://www.siphonicflowmandiri.com/upload/files/dosapiperilem.pdf
    • http://chiaranannini.com/userfiles/files/95321872591.pdf
    • http://zavalinka.by/var/upload/file/ponadegizun.pdf
    • https://unosms.us/userfiles/file/91246523766.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.