Malicious PDF — malware analysis report

Static analysis result for SHA-256 69ecda29a483ea68…

MALICIOUS

PDF

78.9 KB Created: 2021-09-19 17:12:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: e384440ddcc24db29f74ae00bab310ed SHA-1: 7bedf4cb33c00e7aed5f23333247b509f33badc6 SHA-256: 69ecda29a483ea68056ab142fce3560f4d091759dabd92d7d841e78672e43cb3
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as a malicious PDF by ML classifiers and ClamAV. It contains numerous external URIs, with one specifically noted as a link farm on disposable hosting, suggesting a phishing or malware distribution attempt. The PDF structure and embedded URLs indicate it's likely a lure to external malicious content, possibly exploiting PDF vulnerabilities or directing users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9953

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=how+to+set+up+sos+on+android
    • https://feldmann.pl/userfiles/file/69907212620.pdf
    • https://camelcarpet.org/d/files/bonajorijinaporenufax.pdf
    • http://ros.by/ckfinder/userfiles/files/bazeramojutexexizi.pdf
    • https://suacuacuontoanphat.com/upload/files/xizatudutijub.pdf
    • http://bukharageorgia.com/sites/default/files/file/sukixugosajiv.pdf
    • https://www.spoton.pet/wp-content/plugins/super-forms/uploads/php/files/1j2nh5o65qcurbuve134k8sc6c/54773582608.pdf
    • http://leadingedgecorporate.com/user_images/file/talad.pdf
    • http://eko-baby.ru/userfiles/file/96870930153.pdf
    • http://brukikostka.pl/uploads/page/file/78391242697.pdf
    • http://bisenzia.it/userfiles/files/suzodisekazerixojasibesu.pdf
    • http://agrobud.net/uploaded/file/93572228875.pdf
    • http://www.akutrans.com/wp-content/plugins/formcraft/file-upload/server/content/files/16140bd36df283---67691366874.pdf
    • http://otohondamientay.com/upload/files/vojuwomanuwaxis.pdf
    • https://yucekalipmakina.com/tsrm1/img/userfiles/file/42474620405.pdf
    • https://kolegium.inaheart.org/upload/files/13660323180.pdf
    • https://laatjehuisweerstralen.nl/upload/file/buzapitimekapavomura.pdf
    • http://merrygoldholidays.com/ckfinder/userfiles/files/wutozevo.pdf
    • http://bidmitt.com/img/files/file/68185702356.pdf
    • http://bacsiha.com/public/ckfinder/userfiles/files/medovosupawo.pdf
    • http://sibinetweek.ru/userfiles/file/9614896784.pdf
    • http://imosa.asia/uploads/files/202109131412068922.pdf
    • http://thaimassagemodel.com/ckfinder/userfiles/files/pimidekapemukizidu.pdf
    • http://fourfoods.com/images/files/52189758901.pdf
    • https://gabconstruction.com/ckfinder/userfiles/files/75529930301.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc66.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCC66 16792 bytes
font_01_sfnt_off0000e47d.bin
4e295ac1b1f74d6b4869afae4e2ffca89143b94839273261c94bc57effab49a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE47D 10516 bytes
font_02_sfnt_off0000fc91.bin
18439273a3a3b61cbd0c39b74b4a14eb93884590e802aa1da5cbf6ca12a3c314		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC91 18984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.