PDF malware analysis — malicious · 5c877d2b159c73c9

MALICIOUS

PDF

77.6 KB Created: 2021-09-19 06:15:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: 34ddc11fce6b68ad0eac90a52220a094 SHA-1: f56ef838f6e41a01e45a9f8249b3d23ff2494eb6 SHA-256: 5c877d2b159c73c97d94199c03f49b72f731fab46b4ed31d63adf414867e34ee

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs pointing to external domains, indicating a phishing or redirection attempt. Heuristics like 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'ML_NYX_PDF_MALICIOUS' strongly suggest malicious intent. The ClamAV detection as 'Pdf.Phishing.Trojan' further confirms its malicious nature, likely serving as a lure to download further payloads or phish credentials.

Machine Learning

Nyx PDF Classifier malicious score 0.6381

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://synerhu.ru/uplcv?utm_term=second+largest+muscle+in+the+body PDF link annotation
- https://etcbt.com/userfiles/file/menawaribozopigivupewokom.pdfIn PDF document text
- http://auburn-properties.com/userfiles/files/lubafeniripasoz.pdfIn PDF document text
- http://reanda.com/jingkelun/userfiles/files/20210904013411.pdfIn PDF document text
- http://villkasz.hu/editor_up/94765660494.pdfIn PDF document text
- https://flims.atelierleuthold.ch/userfiles/files/lewuzonovubadijagaregepus.pdfIn PDF document text
- https://s-h.cc/uploads/files/202109121803585297.pdfIn PDF document text
- http://bwc.lt/i/42742952825.pdfIn PDF document text
- https://gestcargo.com/uploadfiles/file/13257276269.pdfIn PDF document text
- https://mudraconsultancy.com/uploads/files/vonemuvipibadexowamu.pdfIn PDF document text
- http://czpohledavky.cz/userfiles/files/fotus.pdfIn PDF document text
- http://safiorida.nl/operatori/userfiles/file/razopafakopefug.pdfIn PDF document text
- https://kolegium.inaheart.org/upload/files/5480262550.pdfIn PDF document text
- http://zhxndl.com/uploadfiles/files/36988465574.pdfIn PDF document text
- https://www.icicle-mountaineering.ltd.uk/ckfinder/userfiles/files/38756204251.pdfIn PDF document text
- https://orangcar.com/app/webroot/upload/files/mebivebas.pdfIn PDF document text
- http://xn----7sbicwad4afgcgd5aph7d5e.xn--p1ai/ckfinder/userfiles/files/51216122763.pdfIn PDF document text
- http://versobrokers.eu/userfiles/files/vozogipowexiter.pdfIn PDF document text
- http://qianlong99.org/ckfinder/userfiles/files/61149059591.pdfIn PDF document text
- http://tzsunup.com/upload/nopitidoxoja.pdfIn PDF document text
- http://ukonlinedirect.com/userfiles/files/93139550198.pdfIn PDF document text
- https://tims.ro/ckfinder/userfiles/files/famuveluxi.pdfIn PDF document text
- http://pneusmarene.it/images/file/xedubebuvuzijowubam.pdfIn PDF document text
- http://thesciencenetwork.org/uploads/files/71395487285.pdfIn PDF document text
- http://obrienbuilders.com/userfiles/file/90756563238.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000de27.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDE27	11248 bytes
SHA-256: `b56971ec1f4092409c4fcebf47810e218f1c1b92ecad1b9253591c2b3d06c6dc`
`font_01_sfnt_off0000f828.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF828	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off0001103a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1103A	17148 bytes
SHA-256: `b0d8f865decc0e6743590c33df7556e8666540b2d5a85024c4b230fbe581032e`

Open this report in the interactive analyzer, or submit your own file for analysis.