PDF malware analysis — malicious · 69e9ae0eb596d048

MALICIOUS

PDF

62.3 KB Created: 2021-10-01 12:29:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24

MD5: 90403926c7275fbda6efdc39a6137bac SHA-1: a0c820ecee4f703107b080f1c73810a62649c9eb SHA-256: 69e9ae0eb596d048575e54fd2950bd28bd63ab821097560d5183b13b507fd58c

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a critical heuristic. It functions as a link farm, presenting numerous distinct hosts and URLs, many of which are hosted on disposable domains. The embedded URL and the document body suggest a lure related to downloading 'attack on titan mobile download apk', likely a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier suspicious score 0.2676

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://wintec-samu.hu/uploads/files/jalesonupidezedozito.pdf In PDF document text
- https://accuratesearch.com/userfiles/file/76080656644.pdfIn PDF document text
- http://balatonfurediallatorvos.hu/userfiles/file/vobofaxofevotirufemajus.pdfIn PDF document text
- http://antichigelsi.it/userfiles/files/33973896763.pdfIn PDF document text
- http://yh-nutri.com/filespath/files/20210912105118.pdfIn PDF document text
- http://firewheels.pe/userfiles/file/17985161594.pdfIn PDF document text
- http://ccshecea.org/upload/files/wolowedufixazigakidogeniv.pdfIn PDF document text
- http://architettotamborra.eu/userfiles/files/jusavitikabawasowezub.pdfIn PDF document text
- https://deltarealestate-eg.com/userfiles/file/59692857887.pdfIn PDF document text
- http://onnetsolution.in/userfiles/file/41978130167.pdfIn PDF document text
- http://newabel.com/ckfinder/userfiles/files/23414126120.pdfIn PDF document text
- http://xz-brand.com/ckfinder/userfiles/files/87392216571.pdfIn PDF document text
- https://www.caesarstravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612fcd4b453ab---musopuzo.pdfIn PDF document text
- https://drahmetbostanci.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614656e0b7fb2---nubukebonavoseka.pdfIn PDF document text
- http://dlzj.net/upload/files/20210905040537831754.pdfIn PDF document text
- https://jensbrode.de/files/file/lekukomizo.pdfIn PDF document text
- http://franceplus.fr/userfiles/file/84402143729.pdfIn PDF document text
- http://aranysolyomfeszke.hu/editor_up/punajuvosimisutalo.pdfIn PDF document text
- http://dispensapertutti.com/userfiles/files/21600191452.pdfIn PDF document text
- http://elitvorota.ru/f/file/56293265005.pdfIn PDF document text
- http://cn-daomeng.com/upload/userfiles/files/b241822a50df63b51507e644bd9c77f6.pdfIn PDF document text
- http://tbeaindia.com/userfiles/file/keradaxalenozivefet.pdfIn PDF document text
- http://fpole.ru/sadm_files/vijumilevojizomozat.pdfIn PDF document text
- https://evrenmentese.com/upload/ckfinder/files/xonol.pdfIn PDF document text
- http://chothuethietbi.info/img/files/robapepasuxitexafi.pdfIn PDF document text
- http://montpellier-business-plan.eu/mbp/upload/images/images/upload/ckfinder/81150325521.pdfIn PDF document text
- http://hiredriver.com/uploads/assets/files/17493069759.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=attack+on+titan+mobile+download+apkPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b5b9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB5B9	15012 bytes
SHA-256: `d0db1d41c187ed851095521bee59c5f0fee53a942257d97e667d7af45878baec`
`font_01_sfnt_off0000dbac.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDBAC	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.