Malicious PDF — malware analysis report

Static analysis result for SHA-256 4de72963497315d5…

MALICIOUS

PDF

113.4 KB Created: 2021-04-15 20:11:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 102a6230a079587f411686e9cd1d4db7 SHA-1: 13471930c60712e911476233ec6b9914b0b6ad7f SHA-256: 4de72963497315d59f98362389d9293900fb6d1ed05fc22898c392fdf3731a9b
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to disposable domains and are likely part of a link farm designed to distribute malicious content or phish users. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment. No scripts were extracted, but the structure and URL patterns indicate a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4688

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=introduction+to+philosophy+classical+and+contemporary+readings+fifth+edition PDF link annotation
    • http://yozi.store/new_tamil_movies_2019_free_tamilrockersq5qku.pdfIn PDF document text
    • http://helpforteam.com/love_breakup_images_in_tamilbe57d.pdfIn PDF document text
    • https://molujeridinu.weebly.com/uploads/1/3/4/4/134400438/4558536.pdfIn PDF document text
    • http://belplitka.ru/kuta_software_infinite_algebra_1_combining_like_terms_worksheet_answersg7u8p.pdfIn PDF document text
    • https://jinobodusere.weebly.com/uploads/1/3/4/7/134722577/bojeganuga_tivimitagi_jezuru.pdfIn PDF document text
    • http://good-production11.site/61097064736i0i0e.pdfIn PDF document text
    • https://ditakusoboke.weebly.com/uploads/1/3/1/4/131437623/fa76f3ce9b3e.pdfIn PDF document text
    • http://lazotub.mywebcommunity.org/contoh_amdal.pdfIn PDF document text
    • http://xemizawufogutuf.scienceontheweb.net/how_to_clean_mr_coffee_maker_10_cup.pdfIn PDF document text
    • https://pixojewunut.weebly.com/uploads/1/3/2/6/132695451/2119169.pdfIn PDF document text
    • http://euroshopmn.space/31919556011quk8p.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/184edee8-6616-401a-a56d-1a31dcac6c4d/wizard_sewing_machine_models.pdfIn PDF document text
    • http://wolobugoxew.myartsonline.com/bridge_to_terabithia_play_script.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e332147b-30ef-4854-9f13-ad1142a389b7/how_to_disassemble_speed_queen_washing_machine.pdfIn PDF document text
    • https://s3.amazonaws.com/jazuravazaguz/63079489908.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1dc94e53-b9b9-455b-9734-2b38f5de5dba/21866108858.pdfIn PDF document text
    • http://wegamaluperetuj.atwebpages.com/55575153921.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbe1cfb3-0e55-4c75-bde7-59771f670be2/the_girl_from_ipanema_astrud_gilberto_joo_gilberto_and_stan_getz_mp3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86e7ab08-f9ad-4a6d-b206-9be3a49948de/63218782439.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c0f7c35-b50a-4119-b03c-29ad33281a4b/vivofit_jr_3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67d74d4c-9f33-4d70-af49-62e2eb012ab3/tri_tronics_classic_70_g3_transmitter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81902042-003a-4142-990d-4d89774b84b6/how_to_control_dc_motor_with_arduino_code.pdfIn PDF document text
    • https://s3.amazonaws.com/nijosinizo/brothers_in_arms_acoustic_tab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d0e9351-db2c-436c-93ce-218c79b7a58f/vizio_38-inch_2.0_channel_sound_bar_sb3820-c6.pdfIn PDF document text
    • https://s3.amazonaws.com/gedimuta/date_sheet_aiou_ma_education_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b5b7a94-3b5b-4107-bb7a-83b74ca2a4f3/why_do_smoke_detectors_go_off_intermittently.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019b44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19B44 5608 bytes
SHA-256: 22a6e2ac929ef59de6daac955c5805f2d7b57faf79cf0d9af93568e35b2554ba

Open this report in the interactive analyzer, or submit your own file for analysis.