Malicious PDF — malware analysis report

Static analysis result for SHA-256 723d17048930b71b…

MALICIOUS

PDF

82.0 KB Created: 2021-09-21 08:33:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14
MD5: 223483dfb6037bb37678aaf68aa25a7e SHA-1: 97d1a8a4a8adb592ea1645e4ecb341fca929b650 SHA-256: 723d17048930b71b7cf25eff4213dae7deaf85f75618a4dd6fdfa66c47beea10
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, which is a common technique for exploiting PDF vulnerabilities or redirecting users. The presence of numerous external URIs, many pointing to potentially compromised or disposable domains, strongly suggests a phishing or malware distribution campaign. ClamAV detection further confirms its malicious nature.

Machine Learning

  • Nyx PDF Classifier clean score 0.2214

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.esicm-old.org/admin/lib/ckfinder/userfiles/files/20603291438.pdf In PDF document text
    • https://ijaetis.org/ckfinder/userfiles/files/15386321219.pdfIn PDF document text
    • https://sfasg.jp/js/ckfinder/userfiles/files/29021933657.pdfIn PDF document text
    • https://rowanmkt.com/Uploads/ckfinder/userfiles/files/gejeg.pdfIn PDF document text
    • http://www.airportlimofortlauderdale.net/wp-content/plugins/formcraft/file-upload/server/content/files/1613d48c8e7855---jikinawewurifubozef.pdfIn PDF document text
    • http://oticonshop.com/ckfinder/userfiles/files/72913600075.pdfIn PDF document text
    • http://homespakistan.net/magzine/uploadfiles/file/92858776742.pdfIn PDF document text
    • http://tythb.cn/uploadfile/files/wukexoxupemejufef.pdfIn PDF document text
    • https://jgranit.pl/userfiles/file/93414081421.pdfIn PDF document text
    • https://culturasiapamplona.com/guiarte_userfiles/files/52128761860.pdfIn PDF document text
    • http://dgjinhak.kr/DATA/upload/files/202109211028058438.pdfIn PDF document text
    • http://aow.infogestnet.it/ckfinder/userfiles/files/pomexokivobot.pdfIn PDF document text
    • https://guenangequitation.fr/www/site/js/ckfinder/userfiles/files/76829817165.pdfIn PDF document text
    • https://livre-art.com/ckfinder/userfiles/files/43640925181.pdfIn PDF document text
    • https://bloomlight.pl/_bloom/file/sewafuzotilawoxip.pdfIn PDF document text
    • http://dallard.fr/ressource/site-image/files/36853712746.pdfIn PDF document text
    • http://miet-boot.ch/images/uploadedimages/file/54023073360.pdfIn PDF document text
    • https://nistd.in/userfiles/file/sunupuxel.pdfIn PDF document text
    • http://sushiyaslo.com/uploads/files/55717318795.pdfIn PDF document text
    • http://jamalcar.com/userfiles/file/sujikedagavomupegezefimom.pdfIn PDF document text
    • https://dichvumoinoi.com/ckfinder/userfiles/files/wuzomewebudadelegapi.pdfIn PDF document text
    • https://uleshuzataruhaz.hu/files/file/pajafalevekeretizawak.pdfIn PDF document text
    • https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/54119821e49747642269ebec5f91eac7/xewawulaxafebaredezol.pdfIn PDF document text
    • http://auswallendorf.de/userfiles/file/jerib.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/fzgW7-mxBc0/uplcv?utm_term=how+to+train+your+dragon+mod+apkPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6B8 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000fecf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFECF 10772 bytes
SHA-256: 9cd5f4182286c489775494baf4931ebc1e0b43ed4395be8da4793c62847b383d
font_02_sfnt_off0001175c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1175C 18972 bytes
SHA-256: ba47fb1534826ae619f3b67834bc5eb3ba442978eb9ff22e7244accc7f1621b7

Open this report in the interactive analyzer, or submit your own file for analysis.