PDF malware analysis — malicious · 76513ace7e93271a

MALICIOUS

PDF

81.8 KB Created: 2021-09-15 09:02:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07

MD5: 0edd1473a9b1f00c5fd37f154f563036 SHA-1: 1c96d5530bbf714678d347384f6cecb63e517cbb SHA-256: 76513ace7e93271a9b2a59f14da0edea0e58051daf6610969baed8b635cf9132

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs pointing to external domains, indicating it functions as a link farm. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a malicious intent, likely phishing or malware distribution. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' further supports this by identifying the PDF's structure as a link farm on disposable hosting.

Machine Learning

Nyx PDF Classifier suspicious score 0.4437

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://synerhu.ru/uplcv?utm_term=what+are+the+important+latitudes PDF link annotation
- http://gpsputhuppally.com/userfiles/file/76778354404.pdfIn PDF document text
- http://naturabliskociebie.pl/userfiles/file/jewiwafer.pdfIn PDF document text
- https://annekienlen.fr/imagesfile/47428371850.pdfIn PDF document text
- http://immobilier-valence-agen.com/userfiles/file/didapo.pdfIn PDF document text
- http://biznesfishki.ru/files/userfiles/files/85725919810.pdfIn PDF document text
- http://xecuoihuyhoang.com/uploads/userfiles/file/99529010309.pdfIn PDF document text
- http://ms-krmelin.cz/app/webroot/files/files/mezutaxepixoso.pdfIn PDF document text
- http://stagelight.pl/userfiles/files/zuzubijipufekilibufixa.pdfIn PDF document text
- http://ahknchem.com/upload/files/jefetinunimugexutorov.pdfIn PDF document text
- http://kwik-it.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1614176ea529c3---sisoga.pdfIn PDF document text
- http://benetalent.com/upload/files/xederoxuvawakutupesegudi.pdfIn PDF document text
- http://5mal4.de/moneyvidya/web/images/userfiles/file/fipavizutasik.pdfIn PDF document text
- https://lensmam.com/userfiles/file/74299112246.pdfIn PDF document text
- https://www.xtremefitness.com.au/application/third_party/ckfinder/userfiles/files/24209448415.pdfIn PDF document text
- http://chukguwang.com/files/fckeditor/file/pufuminefiwekabuze.pdfIn PDF document text
- http://ukkies.be/userfiles/file/48094422996.pdfIn PDF document text
- http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/1613f353c2de41---fodubovurosowufuk.pdfIn PDF document text
- https://perfecthospital.org/FCKeditor/file/ledusote.pdfIn PDF document text
- http://intertermo.nl/userfiles/file/69325180070.pdfIn PDF document text
- http://fresh-j.info/images/uploadedimages/file/wobiro.pdfIn PDF document text
- https://sharkovinkom.com/sharkovinkom.com/ckfinder/userfiles/files/sepufibig.pdfIn PDF document text
- http://www.gieskestukadoors.nl/ckfinder/files/files/28631378720.pdfIn PDF document text
- http://pnc21.com/files/fckeditor/file/1348105933613540b717f85.pdfIn PDF document text
- https://emotionalgift.com/ckfinder/userfiles/files/xexujaxemadiv.pdfIn PDF document text
- http://kodemari.info/data/files/refosodunat.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e9e3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE9E3	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off000101f5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x101F5	17744 bytes
SHA-256: `f2e06168c1d673d35c6e1c61a4d6058217a60e9f22fa9b77c59d10c27ec8b988`
`font_02_sfnt_off0001300a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1300A	10748 bytes
SHA-256: `7c33a53a9996369a85a93e6c88a7cec070c0434666bdc0dfbaf44d3a88084d13`

Open this report in the interactive analyzer, or submit your own file for analysis.