Malicious PDF — malware analysis report

Static analysis result for SHA-256 5993ffbab6b44cd9…

MALICIOUS

PDF

69.5 KB Created: 2021-10-04 15:07:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: c34533fae7eb590bbfaa1fb0b3debede SHA-1: dff68194cdf13b88e4acc4e5525b4c1c0a02566f SHA-256: 5993ffbab6b44cd906672be766718b2b357e902bc93b55d985d0d7d66378135a
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, which is often used to redirect users to malicious websites. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is part of a link farm, further supporting a phishing or malicious redirection scheme. The ClamAV detection as 'Pdf.Phishing.Trojan' confirms the malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6323

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jmclimatizacionhvac.cl/images/subidas/file/68159847478.pdf In PDF document text
    • https://www.ibyservice.com/wp-content/plugins/super-forms/uploads/php/files/4688f941738c062d392ee6b5a7715925/tisodifurilukuveroguroge.pdfIn PDF document text
    • http://massimobertoarchitetto.com/userfiles/files/rimana.pdfIn PDF document text
    • http://miraesusan.com/ckupload/files/kifakapijodolozedipi.pdfIn PDF document text
    • http://dominopark.pl/public/upload/ckfinder/userfiles/files/1705952730.pdfIn PDF document text
    • https://alcc.c-zentrix.com/ALCC/mail_attachments/multitenant-ws-01/1/1632913185.pdfIn PDF document text
    • http://lienming-rubber.com/uploads/files/202109101344252044.pdfIn PDF document text
    • http://3mfa.com/images/editor/files/89170065009.pdfIn PDF document text
    • http://askaudit.ru/price/96169763193.pdfIn PDF document text
    • http://pck.malopolska.pl/wp-content/plugins/super-forms/uploads/php/files/1e4656bf7ea5066099ad3010a3f5329a/31216565079.pdfIn PDF document text
    • https://lensprovn.com/ckfinder/userfiles/files/80455803242.pdfIn PDF document text
    • http://cathyourhair.nl/js/ckfinder/userfiles/files/48686308787.pdfIn PDF document text
    • http://www.heksan.com.pl/file/27336754683.pdfIn PDF document text
    • http://globalsublimation.net/uploadfile/files/40367835429.pdfIn PDF document text
    • http://garmaclima.com/uploads/ckfinder/files/70405972755.pdfIn PDF document text
    • https://oncallanatomist.org/ckfinder/userfiles/files/30724740867.pdfIn PDF document text
    • http://www.gonouvellezelande.com/files/jaxekisukam.pdfIn PDF document text
    • http://wx-bm.cn/upload/ckimg/files/202109180244144163.pdfIn PDF document text
    • https://miaousland.fr/ckfinder/userfiles/files/21492393627.pdfIn PDF document text
    • http://condominiobrisasdelnorte.com/userfiles/file/66016751453.pdfIn PDF document text
    • http://seoulgreeter.com/userData/board/file/11436179201.pdfIn PDF document text
    • http://precisionsurgicalworks.com/alpha/ckfinder/userfiles/files/74039752800.pdfIn PDF document text
    • http://bio-scan.com/userfiles/file/bozepelumojugepapowi.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/fzgW7-mxBc0/uplcv?utm_term=state+theater+portland+mainePDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e724.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE724 20276 bytes
SHA-256: 7077005225febf5f019dc69860e61dfcc6354f4b8f5b02642d4d4544b13e60b6

Open this report in the interactive analyzer, or submit your own file for analysis.