Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ad220dc8895aafc…

MALICIOUS

PDF

70.2 KB Created: 2021-09-24 12:52:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 446cb0553f6530843aee8aeff02ef1a8 SHA-1: 97b072eada5a1cfcfe914008e1e15e4a39e993e0 SHA-256: 3ad220dc8895aafcb685f5c774b4a2c03433254fb2743e77cb9ecaa04286a68c
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, which is a common technique for executing malicious code within documents. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is designed to host multiple links on disposable domains, suggesting a phishing or spam campaign. The embedded JavaScript likely facilitates the redirection to one of the numerous external URLs found, such as http://www.restorationservice.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1614c7f4467a03---judumadakinivutiketib.pdf, to deliver a secondary payload or phish for credentials.

Machine Learning

  • Nyx PDF Classifier clean score 0.2445

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.restorationservice.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1614c7f4467a03---judumadakinivutiketib.pdf In PDF document text
    • https://cowichanseniors.ca/userfiles/file/jofopudijox.pdfIn PDF document text
    • https://benqmusicworkshop.com/fupload/file/wudufenav.pdfIn PDF document text
    • https://techielingo.com/fck_uploads/files/70167667501.pdfIn PDF document text
    • https://fceresources.com/ckfinder/userfiles/files/9225216749.pdfIn PDF document text
    • http://bikipvuikhoedep.com/app/webroot/files/editor_upload/files/84956557799.pdfIn PDF document text
    • http://novosib-sport.ru/ckfinder/userfiles/files/gogitatobanokatepol.pdfIn PDF document text
    • http://enovosti.info/ckfinder/userfiles/files/sutazofizejefevu.pdfIn PDF document text
    • https://clinicscrm.com/img/files/nuboluwi.pdfIn PDF document text
    • https://jvlegacyhomerepairsmd.com/nbloom/fckuploads/file/sikutisadube.pdfIn PDF document text
    • http://rsti.biz/files/fck/file/tilafav.pdfIn PDF document text
    • https://reaga.net/js/ckfinder/userfiles/files/69692620690.pdfIn PDF document text
    • http://seychelles-resort.com/images/blog/file/47721566397.pdfIn PDF document text
    • http://abwmarlboropike.com/uploads/files/72641129721.pdfIn PDF document text
    • https://attack.lt/images/files/30118562465.pdfIn PDF document text
    • http://bajcsidavidfoto.com/_user/file/muvilazogaf.pdfIn PDF document text
    • http://azbuka-d.ru/ckfinder/userfiles/files/doramukofoto.pdfIn PDF document text
    • http://hiroshima-teishaku.com/userfiles/file/fulad.pdfIn PDF document text
    • http://www.petersonassoc.com/emailimages/file/55106729150.pdfIn PDF document text
    • https://h1t-url12shio-turbo.com/contents/files/toxenagimisut.pdfIn PDF document text
    • http://www.cargeacrew.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/161419c2348910---ribetefuz.pdfIn PDF document text
    • https://www.albriug.com/static/editor/ckeditor/ckfinder/upfile/files/pobupefavumok.pdfIn PDF document text
    • http://camonetinternational.com/files/file/vitupijizowute.pdfIn PDF document text
    • http://www.ciesol.es/ckfinder/userfiles/files/77102481147.pdfIn PDF document text
    • http://asupuro.com/upload/save_image/files/xeliguj.pdfIn PDF document text
    • https://holcom-wd.com/webroot/img/files/11387946101.pdfIn PDF document text
    • http://sp3siemianowice.pl/userFiles/files/4675695837.pdfIn PDF document text
    • http://pactolous.hu/upload/file/64129736204.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3vuEKuznOb8/uplcv?utm_term=cara+membuat+emoticon+android+seperti+iphonePDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dffc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFFC 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000f813.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF813 11004 bytes
SHA-256: 67498a315ffaa98c8ef78f6c451a8d0227012f8858292ef62d523d6f72f6e8b8

Open this report in the interactive analyzer, or submit your own file for analysis.