Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d35ac3c12e02dff…

MALICIOUS

PDF

85.9 KB Created: 2021-09-13 20:48:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: f6794965ba10053e3af7cf21f341df14 SHA-1: d808e658887274db47d10f4e374ae866772a257c SHA-256: 4d35ac3c12e02dff9406606f29136ba4e6f51a769552d39c98267851abdc1352
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristics identified it as a link farm designed to obscure the true destination of downloads, with numerous distinct hosts and disposable URLs. The embedded URLs and the PDF's structure suggest it is part of a phishing or malware distribution scheme, likely attempting to trick users into downloading unwanted software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6235

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mwbright.com/upload_fck/file/2021-9-6/20210906133237169697.pdf In PDF document text
    • http://baracenter.be/userfiles/file/xaxemizajemaropufotepe.pdfIn PDF document text
    • http://www.verneteco.com/ckfinder/userfiles/files/50987692026.pdfIn PDF document text
    • https://terlickodds.cz/www/www/fckphotos/file/71277156453.pdfIn PDF document text
    • https://leganordavigliana.it/uploads/file/99018601176.pdfIn PDF document text
    • http://studiotecnicofrisoli.com/userfiles/files/zedukonoriwubu.pdfIn PDF document text
    • https://xn--22ck6bdp5cach0mc23a.com/ckfinder/userfiles/files/28476761679.pdfIn PDF document text
    • http://silverspringabw.com/uploads/files/86733350385.pdfIn PDF document text
    • http://christmaslandint.com/userfiles/vozapu.pdfIn PDF document text
    • http://elandtour.com/FileData/ckfinder/files/20210913_C4BA8C1A06D15D99.pdfIn PDF document text
    • http://rooptex.com/uploads/95146242912.pdfIn PDF document text
    • http://bertrandetgastineaudesigners.fr/userfiles/file/68868961854.pdfIn PDF document text
    • https://gberwanda.com/gbe/useruploads/blogs/files/87039053184.pdfIn PDF document text
    • https://seger.cz/userfiles/file/sofovuviwalitozupenudub.pdfIn PDF document text
    • http://xy-interior.com/uploads/files/202109012122554869.pdfIn PDF document text
    • https://www.teppiche-waschen-hamburg.de/wp-content/plugins/formcraft/file-upload/server/content/files/16139e981186a2---zejuzizupu.pdfIn PDF document text
    • http://www.dilipprabhavalkar.com/images/file/jubejofedizutude.pdfIn PDF document text
    • http://euro520.net/userfiles/file/16308799471717485090.pdfIn PDF document text
    • http://sity-luxe.ru/userfiles/file/27371871948.pdfIn PDF document text
    • http://www.klimavill.com/data/editorfile/moginuxawubosavifan.pdfIn PDF document text
    • http://queuemanagementsystems.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613a3cb72e477---84114991039.pdfIn PDF document text
    • https://7mark3t2-7aya.com/contents/files/nevizifepagexenedariwiven.pdfIn PDF document text
    • http://canyonoaksmtg.com/~duckdi5/canyonoaksmtg.com/content/file/1527100030.pdfIn PDF document text
    • https://retta-bg.com/userfiles/2659299936.pdfIn PDF document text
    • https://irastuff.com/admin/ckfinder/uploads/files/4318937770.pdfIn PDF document text
    • http://lexuspolymers.com/assets/ckfinder/userfiles/files/fulixotesezixamekikuredar.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BvfzZFkJO3s/uplcv?utm_term=download+gta+5+pspPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0AD 16064 bytes
SHA-256: f76835efc0f70b52b211676925d3c3919e6952eec6cd10f320d1ab287c5fabf2
font_01_sfnt_off0000f5be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5BE 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00010dd0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DD0 20116 bytes
SHA-256: b6e9f7a48835919ea7a8cec7374ff014931128c3d2406d702952a2fa0c9dc069
font_03_sfnt_off000140e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x140E0 10464 bytes
SHA-256: 18c06134da94a183d7350ab7c70ca6e8252393881673c5d4d3eddf0b03cf66aa

Open this report in the interactive analyzer, or submit your own file for analysis.