PDF malware analysis — malicious · 80f2f754b9ea9c23

MALICIOUS

PDF

81.7 KB Created: 2021-09-17 12:28:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11

MD5: e367a08bfaff92b1794221c7601c48b5 SHA-1: 04ac6c18c9cd2d0ce982ec3492dbedd5b7a2842b SHA-256: 80f2f754b9ea9c23ac074445067be4f9521273155a3c43d2861c5dd7a9fd123f

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with high confidence. It functions as a link farm, containing numerous embedded URLs pointing to other PDF files hosted on various domains. This pattern is commonly used to distribute phishing content or further malware stages, making it a likely component of a larger attack chain.

Machine Learning

Nyx PDF Classifier malicious score 0.5932

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://krisoc.ru/uplcv?utm_term=how+to+remove+deleted+items+from+android+phone PDF link annotation
- https://shevian.com/images/file/tufefoduvosuwezimez.pdfIn PDF document text
- http://belniig.by/public/file/salosizemupezusufaleti.pdfIn PDF document text
- https://profix.fr/ckfinder/userfiles/files/gititova.pdfIn PDF document text
- https://saikekanglun.com/filespath/files/20210903185104.pdfIn PDF document text
- http://nc-israel.ru/upload/files/43789381554.pdfIn PDF document text
- http://jubileejec.com/userfiles/files/54701618444.pdfIn PDF document text
- http://discarga.com/wp-content/plugins/formcraft/file-upload/server/content/files/16133ea82e156a---87493600158.pdfIn PDF document text
- http://xperion.hu/wp-content/plugins/super-forms/uploads/php/files/2d59b0f56a99ab9eabfcef9bb9bac35e/84879646028.pdfIn PDF document text
- https://iva-vietnam.com/userfiles/file/38608286198.pdfIn PDF document text
- http://fredericjean.net/oplusco/file/41953293763.pdfIn PDF document text
- http://thietbiotovn.com/Images_upload/files/31897407616.pdfIn PDF document text
- http://yoga-privates.com/yoga-privates/file/novevadabutoxelomobu.pdfIn PDF document text
- http://tranindo.com/Uploads/userfiles/files/28423647524.pdfIn PDF document text
- https://predial-rua-nova.pt/056-CovadaLua/images-editor/file/32105017217.pdfIn PDF document text
- https://speakingparrot.com/upload/ckfinder/files/fitixejoxafirusorupi.pdfIn PDF document text
- http://expertsystemgroup.com/file_media/file_image/file/soreseredaterot.pdfIn PDF document text
- http://sartoriaventurini.com/userfiles/files/33846947848.pdfIn PDF document text
- https://eliteplacementagency.com/uploads/files/ranafefo.pdfIn PDF document text
- http://apple888.vn/luutru/files/napodasaviwuzenuduxibonis.pdfIn PDF document text
- http://104408017.linker.tw/files/37456055569.pdfIn PDF document text
- https://www.channeloflove.com/ckfinder/userfiles/files/92640669146.pdfIn PDF document text
- http://ck-kutnahora.cz/gais/image/file/likimebeninek.pdfIn PDF document text
- http://studionegrelli.it/userfiles/files/wakeruvu.pdfIn PDF document text
- http://firegallery.ru/img/upload/80813349203.pdfIn PDF document text
- http://esistore.com/userfiles/file/bujus.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e50b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE50B	18120 bytes
SHA-256: `980d39acf14df28dbffc6412c430c094c0393f7eef39f9c85a60e746b9329a95`
`font_01_sfnt_off00011499.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11499	10904 bytes
SHA-256: `e41147d70bd83ebe7fc0038bd9cc47a799d6cef31af07a5f5955f20f7f3d8085`
`font_02_sfnt_off00012da4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12DA4	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.