Malicious PDF — malware analysis report

Static analysis result for SHA-256 3dac70d548a9bf48…

MALICIOUS

PDF

74.9 KB Created: 2021-09-19 04:28:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 2d1dbf5634a5635f0dfcc4ad6d297465 SHA-1: c71e30bc3377c38498c7f19d258eec4ff7577395 SHA-256: 3dac70d548a9bf487cb1466871b4bbb3a1d9ac1bac9ac81c424d3275851c5b05
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and contains embedded JavaScript, a common technique for exploiting PDF vulnerabilities or redirecting users. The presence of numerous external URIs, many hosted on disposable domains, strongly indicates a phishing or malware distribution attempt. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports this, suggesting the document is part of a link farm designed to obscure the final malicious destination.

Machine Learning

  • Nyx PDF Classifier clean score 0.2255

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=software+update+apps+for+android PDF link annotation
    • http://tichdiem.surecare.vn/uploads/userfiles/file/gizupakironokunulilis.pdfIn PDF document text
    • https://malabarmail.com/ckfinder/userfiles/files/vonev.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613168c2c0bb4---jesefidovifozadirupuxoju.pdfIn PDF document text
    • http://nandishoverseas.com/UserFiles/File/14520118524.pdfIn PDF document text
    • http://novo-foto.ru/ckfinder/userfiles/files/vodakamufibadivozo.pdfIn PDF document text
    • http://sethhukumchandschool.com/userfiles/file/xujiwerudevup.pdfIn PDF document text
    • https://thai-airpark.com/ckfinder/userfiles/files/jekositu.pdfIn PDF document text
    • http://nazycakes.com/userfiles/file/16620937242.pdfIn PDF document text
    • http://www.poliklinika-hb.cz/userfiles/file/gunosogikamosu.pdfIn PDF document text
    • http://balcimimarlik.com/resimler/files/81416197373.pdfIn PDF document text
    • http://interwork.sk/userfiles/file/44085041539.pdfIn PDF document text
    • http://paolacaone.eu/userfiles/files/pokerim.pdfIn PDF document text
    • https://clickbox.ro/images/file/28349456061.pdfIn PDF document text
    • http://teknis.it/userfiles/files/segejovogitan.pdfIn PDF document text
    • https://bczenekar.hu/files/file/20526240203.pdfIn PDF document text
    • http://solar-makernavi.com/ckfinder/userfiles/files/rujivumopofusawesoleniv.pdfIn PDF document text
    • http://eg-connect.com/php_codes/Scott/VieauAssociates/code/userfiles/file/wizif.pdfIn PDF document text
    • http://tycoonmedical.com/userfiles/file/lulotetogasejanuvak.pdfIn PDF document text
    • http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/1612ee768171ab---puwigavivimikinobarenozim.pdfIn PDF document text
    • http://rund.cz/UserFiles/File/22219198515.pdfIn PDF document text
    • https://omprintandpack.com/userfiles/file/xupeboxirogidejux.pdfIn PDF document text
    • https://venefoil.com/ckfinder/userfiles/files/22011120868.pdfIn PDF document text
    • http://ukrfirework.com/images/file/8384771527.pdfIn PDF document text
    • http://www.erealitysolutions.com/tennisontario/assets/appsadmin/js/ckfinder/userfiles/files/57316405051.pdfIn PDF document text
    • http://cosmikkino.ru/sadm_files/bosugaxigozumefudasaw.pdfIn PDF document text
    • http://packturf.fr/files/pivazowufatesiseritowefoz.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d65d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD65D 10708 bytes
SHA-256: 6509faf284a5a790e7439691d9623f556aa9d120b82558b4fa3df6db385f6d88
font_01_sfnt_off0000ef1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF1B 18320 bytes
SHA-256: 61db6be3e26896184690636275d3676f66b4601d6db0c28d3c81f10080a76fc5

Open this report in the interactive analyzer, or submit your own file for analysis.