Malicious PDF — malware analysis report

Static analysis result for SHA-256 415cd93ab27faabb…

MALICIOUS

PDF

76.2 KB Created: 2021-09-12 03:06:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 8d28679507d95e6448165ab3ea17be39 SHA-1: fe1f6aeaae9d710244a62467932b1d698b68a4cb SHA-256: 415cd93ab27faabb3ceaeb23629e479e0898e7f850bea6545b4c20cec03aec40
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, a common technique for executing malicious code within documents. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a large number of external links, many with UTM parameters, suggesting an attempt to obscure the true destination or to track clicks for a phishing campaign. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely involving redirection to phishing sites.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4602

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://faithleader.org/js/ckfinder/userfiles/files/72426214426.pdf In PDF document text
    • https://trouver-une-ssii.com/img/pics/files/45375699855.pdfIn PDF document text
    • https://careersourceokaloosawalton.com/files/public/fujer.pdfIn PDF document text
    • http://www.protectakoteasia.com/ckfinder/userfiles/files/51984730156.pdfIn PDF document text
    • http://podlahyadvere.sk/editor_uploads/system/files/rivigutuvuxowedeveles.pdfIn PDF document text
    • http://vector-mebel.ru/uploads/files/31674373203.pdfIn PDF document text
    • http://xn--b1agpbmdtf.xn--p1ai/upload/file/pisimupalizuvimigazewewa.pdfIn PDF document text
    • https://kalitelivideoizle.com/resimler/files/temizebudinetad.pdfIn PDF document text
    • http://www.itidharamshala.in/images/uploads/files/fubesazilo.pdfIn PDF document text
    • http://novelinternationalschool.com/ckfinder/userfiles/files/25404284636.pdfIn PDF document text
    • https://ptogel2.com/contents/files/74534016457.pdfIn PDF document text
    • http://mebelhotel.ru/images/news/file/gasipemulobi.pdfIn PDF document text
    • http://mid-europe-ex.com/images/blog/file/verigutebavudusupag.pdfIn PDF document text
    • http://scuderia512.com/js/upload/files/69304651332.pdfIn PDF document text
    • http://herbwaterthailand.com/userfiles/files/mabada.pdfIn PDF document text
    • http://smcertificationservices.com/userfiles/files/kikipupavaz.pdfIn PDF document text
    • http://silver.jo/ckfinder/blanc/files/70296617626.pdfIn PDF document text
    • http://villacappuccina.com/userfiles/files/94341325812.pdfIn PDF document text
    • http://studiolegaletrotta.eu/userfiles/files/gozat.pdfIn PDF document text
    • http://scamps.biz/userfiles/file/37120591200.pdfIn PDF document text
    • https://osikovo.eu/webroot/img/content/files/rupaxigilasanuxuj.pdfIn PDF document text
    • http://www.coverseg.com/uploads/ckfinder/files/474328841.pdfIn PDF document text
    • http://citadelcaralarms.com/userfiles/file/55538547689.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=what+does+the+black+arrow+mean+on+iphonePDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1A5 18184 bytes
SHA-256: fbcd4fad1d4d94aae599d6304b5a58af79ef69dbb9b902e62477d71dfb52b6da
font_01_sfnt_off00010145.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10145 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0001195c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1195C 11092 bytes
SHA-256: 23ce29ba02e1434fc610b1970ebceb383b2ed1eff35f713160cff7ab4d4f4095

Open this report in the interactive analyzer, or submit your own file for analysis.