Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a757160074e4428…

MALICIOUS

PDF

64.0 KB Created: 2021-09-24 01:08:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 6bcc8a46422c805596a1200ae2f40920 SHA-1: 673344475e05fff368b27783218490e0ad26f851 SHA-256: 4a757160074e4428c1fb1bb384828887503fb7fa158fc87e9acb53c594245d6f
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and multiple external URIs, indicating a malicious intent to redirect users to potentially harmful content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggests a tactic to distribute malware through a network of low-reputation websites. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9203

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/uplcv?utm_term=unlock+pdf+password+without+password PDF link annotation
    • http://nhakhoauytinhaiphong.com/upload/files/65424131329.pdfIn PDF document text
    • https://assurancemauricie.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132090fec9ac---45568358139.pdfIn PDF document text
    • https://littleedupark.com/ckfinder/userfiles/files/zifozelilonimowopag.pdfIn PDF document text
    • https://aromamarketing.md/img/files/64853598507.pdfIn PDF document text
    • https://albawadiroad.com/userfiles/files/96982322044.pdfIn PDF document text
    • http://cjatkinson.com/userimages/54988312992.pdfIn PDF document text
    • https://istanbularicilikfestivali.com/upload/ckfinder/files/nixaromalitiramegudulito.pdfIn PDF document text
    • http://sarica.com.tr/ckfinder/userfiles/files/49682198727.pdfIn PDF document text
    • https://www.ijestr.com/ckfinder/userfiles/files/beginaguwotane.pdfIn PDF document text
    • https://x-software.cz/data/file/lugipesetukipixeguf.pdfIn PDF document text
    • https://resortweeks.pro/userfiles/file/67810588329.pdfIn PDF document text
    • https://www.ideaklinikbakirkoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/161320fc22ed49---xixovilapunus.pdfIn PDF document text
    • https://alkathirilaw.com/userfiles/files/76519330337.pdfIn PDF document text
    • https://www.funes.gob.ar/ckfinder/userfiles/files/torokaton.pdfIn PDF document text
    • http://mkbeauty.vn/luutru/files/47202655837.pdfIn PDF document text
    • http://daisin1977.com/js/upload/files/bowipenarezezedavazi.pdfIn PDF document text
    • http://michaelwilliamslaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/87910138830.pdfIn PDF document text
    • http://www.emporiocaritaspisa.it/wordpress/wp-content/plugins/formcraft/file-upload/server/content/files/1613971f54aeb4---zazutew.pdfIn PDF document text
    • https://venusnvs.com/userfiles/file/gemagijenifokenapelu.pdfIn PDF document text
    • https://vrindaindia.com/php/joseph/uploads/file/bokana.pdfIn PDF document text
    • http://ambvetfanini.eu/userfiles/files/41531898151.pdfIn PDF document text
    • http://szwygs.com/upload/kuvuji.pdfIn PDF document text
    • https://conexus-study-abroad-travel.com/ckfinder/userfiles/file/vedijasojiw.pdfIn PDF document text
    • http://thingsantiquesla.com/userfiles/files/retifevopab.pdfIn PDF document text
    • http://fermobkorea.com/userfiles/file/20210909055148.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8E2 10868 bytes
SHA-256: 4e541350257eb7f9f4051a081369438f819f68bed2dfeeec87a20571cdfb8a0d

Open this report in the interactive analyzer, or submit your own file for analysis.