PDF malware analysis — malicious · 6adb38cf3b01dd85

MALICIOUS

PDF

67.9 KB Created: 2021-09-17 15:03:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: cf2c2e9cc7d590a218ac9878251b26b1 SHA-1: f9dedfbdb6693fa912c9953766b53426b85b81b9 SHA-256: 6adb38cf3b01dd8575220ae2fa4d9b81529353a48c55ff55db4f1ebec35f971d

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample is a PDF containing embedded JavaScript and a large number of external URIs, many of which point to disposable domains. The ClamAV detection and the heuristic for a link farm on disposable hosting strongly suggest a phishing or malware distribution campaign. The embedded JavaScript likely facilitates the redirection to these malicious sites.

Machine Learning

Nyx PDF Classifier suspicious score 0.4056

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://archism.ru/uplcv?utm_term=a+quiet+place+part+ii+stream+free PDF link annotation
- http://kwiatmetal.pl/userfiles/file/gebunozokulozinigu.pdfIn PDF document text
- https://adiwirawanbali.com/wp-content/plugins/super-forms/uploads/php/files/972e4c4193526fedd5783bb4c2bce878/bajuzodiliwipunilusukofo.pdfIn PDF document text
- http://gaishachuukobuhin.com/js/upload/files/zumisasasapubovarakaxali.pdfIn PDF document text
- http://www.polni.si/Images/files/36214745.pdfIn PDF document text
- http://studioingtassinari.eu/userfiles/files/sowiperuvotizifusuvab.pdfIn PDF document text
- http://wajl.net/img/file/2021915172020.pdfIn PDF document text
- http://bulgankhangai.mn/userfiles/files/42946664179.pdfIn PDF document text
- http://electriccityusa.com/images/fck_uploads/file/wutav.pdfIn PDF document text
- http://integrotech.pl/zdjecia/file/palofunami.pdfIn PDF document text
- http://www.logistiekverbeteren.nl/ckfinder/userfiles/files/21730802083.pdfIn PDF document text
- http://takramaipai.com/mypicture/file/8501627998.pdfIn PDF document text
- http://boatmonies.com/uploads/files/12392255093.pdfIn PDF document text
- http://maurovalleferroarchitetto.eu/userfiles/files/84120558392.pdfIn PDF document text
- http://hoanhaochemical.com/uploads/files/wijewegivifagezedome.pdfIn PDF document text
- http://familiegravesen.dk/userfiles/file/70016793764.pdfIn PDF document text
- http://autoscuolemontagna.it/userfiles/files/toson.pdfIn PDF document text
- http://eldorautomaticgates.com/UserFiles/file/sikoguzesewenu.pdfIn PDF document text
- http://plymouth-logs.co.uk/ckfinder/userfiles/files/sewumexenezamukumes.pdfIn PDF document text
- https://khabul.mn/mmpa/userfiles/files/zodadiw.pdfIn PDF document text
- http://jfe.hk/userfiles/futosinukiwubamewumanuxen.pdfIn PDF document text
- http://visit-pune.com/userfiles/file/3774831644.pdfIn PDF document text
- https://izharfoster.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612efe27b994d---raxoguliduvutibalamosewaw.pdfIn PDF document text
- http://jenan.com/ckfinder/userfiles/files/7593763659.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b8b2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB8B2	10644 bytes
SHA-256: `a9b1f834e0adb67fbc9961b5f7d24d984d6a4a9b6830a2524dcbcb2af171a2a7`
`font_01_sfnt_off0000d122.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD122	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off0000e934.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE934	17032 bytes
SHA-256: `5f4421b78000f73fb2f592adb87cfe3948e7a7d355575b5a6d98265c734e596e`

Open this report in the interactive analyzer, or submit your own file for analysis.