PDF malware analysis — malicious · 801a279a382d5624

MALICIOUS

PDF

83.9 KB Created: 2021-09-19 21:13:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16

MD5: d14bfc68cc14c06bfa8a2daed8ccdae4 SHA-1: d41750804327a278a170a66a5a574a9ab7dc80ae SHA-256: 801a279a382d5624e70b82ec3ed799bad67d1f0e6a53120102ff2e0e76aff853

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The critical ClamAV heuristic identified this PDF as a phishing trojan. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates the document contains numerous links to disposable hosting, suggesting a link farm designed to obscure the true destination or host multiple malicious payloads. While no scripts were directly extracted, the PDF structure and link farm behavior are indicative of a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier suspicious score 0.4046

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://marljivo.hr/UserFiles/files/4641574362.pdf In PDF document text
- https://cafesca.org/ckfinder/userfiles/files/besigexelobunujofekogixe.pdfIn PDF document text
- https://ntc-container.com/upload/files/48288106774.pdfIn PDF document text
- http://rassadaspb.com/new/files/file/81783436694.pdfIn PDF document text
- https://gdaniec.com/upload/files/dagerarexinake.pdfIn PDF document text
- https://karlholmbygg.se/UserFiles/files/77743369593.pdfIn PDF document text
- http://itagqatar.zajeltel.com/itag/file/files/41176837847.pdfIn PDF document text
- https://www.poolsrus.com.au/application/third_party/ckfinder/userfiles/files/powigadodidurigosawegod.pdfIn PDF document text
- https://ixiu-23.com/uploads/files/202109012158593572.pdfIn PDF document text
- http://alnadaoil.com/userfiles/file/9165726518.pdfIn PDF document text
- https://amthanhanhsangchinhhang.vn/upload/files/bavodarevis.pdfIn PDF document text
- https://elicopter-de-inchiriat.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1613506dac476d---25269920002.pdfIn PDF document text
- http://gemmacapitalgroup.com/foto/file/32623206344.pdfIn PDF document text
- http://galantemontagnana.it/ckfinder/userfiles/files/65990606632.pdfIn PDF document text
- https://we-plus.tw/ckfinder/userfiles/files/diluzoxoponifexo.pdfIn PDF document text
- http://bckbytow.naszbip.pl/img/upload/files/sigomodamagesavexeg.pdfIn PDF document text
- https://traveletrust.com/basefile/traveletrustcom/files/xovajunegevuguwefuso.pdfIn PDF document text
- https://robert-zauer.cz/userfiles/file/gibifuvexa.pdfIn PDF document text
- http://vilocom.net/webroot/img/files/sugiwonupajekugowiretove.pdfIn PDF document text
- http://makinsushi.com/uploads/files/68383337019.pdfIn PDF document text
- http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613e71bd57b52---nigunumamisikapotaz.pdfIn PDF document text
- https://skyzoan.com/cake/beta/userfiles/file/43556367554.pdfIn PDF document text
- http://vita24h.com/uploads/userfiles/file/subinabalaliwipobipi.pdfIn PDF document text
- https://thibiditrading.com/public/userupload/files/49461100919.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=how+to+stop+android+apps+from+accessing+personal+informationPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f0e4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF0E4	18248 bytes
SHA-256: `31915a7fba522911c8c2e5806a1f97c340cc9578566d9740ef2bd1973355cf4e`
`font_01_sfnt_off00012093.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12093	11040 bytes
SHA-256: `159b1d0fc4e64a946564ae631d020f53bd3c66010c1f7311e71988d04aeb0e58`
`font_02_sfnt_off00013a16.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13A16	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.