Malicious PDF — malware analysis report

Static analysis result for SHA-256 83b393712c789427…

MALICIOUS

PDF

74.9 KB Created: 2021-09-10 08:57:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 1522e9495e1b0426ce80961222e7d021 SHA-1: 71c75b6f4f696a616648d8c772aa2044acdc37a6 SHA-256: 83b393712c789427837d843ebd41c367b70bcde8c586f8ea03ce384c91edb172
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The critical ClamAV detection and the presence of embedded JavaScript strongly indicate malicious intent. The PDF contains a large number of external links, many hosted on disposable domains, suggesting a phishing or link-farming operation. The embedded JavaScript likely serves to further the malicious objective, possibly by redirecting the user or downloading additional payloads.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3852

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=lo+lo+box+apk PDF link annotation
    • https://nezamirekhaseafoods.com/userfiles/file/55300340119.pdfIn PDF document text
    • http://basse-normandie.annuaire-regional.com/ckfinder/userfiles/files/78649959703.pdfIn PDF document text
    • https://vasantviharproperties.com/userfiles/file/porip.pdfIn PDF document text
    • http://thinhhoanggia.vn/Images_upload/files/dumaxalub.pdfIn PDF document text
    • http://steinbach.casawell.tw/userfiles/file/33926774820.pdfIn PDF document text
    • http://citysoupsbellevue.com/uploads/files/74039925893.pdfIn PDF document text
    • https://amzentransportationindustries.com/admin/imagetemp1/file/vamadiniwebolosazimuk.pdfIn PDF document text
    • http://algarestofos.pnh.pt/js/ckfinder/userfiles/files/sijixiwetanotebonizumid.pdfIn PDF document text
    • https://www.infratechgroep.nl/wp-content/plugins/super-forms/uploads/php/files/bd7de5f18806a5e0f4af74c2bf949f83/26025172278.pdfIn PDF document text
    • http://grafitym.kz/files/file/97513255100.pdfIn PDF document text
    • http://women-for-marriage.com/ckfinder/userfiles/files/54805381317.pdfIn PDF document text
    • http://www.integra-cr.cz/administrace/ckfinder/userfiles/files/wefajiluvasexelulozuro.pdfIn PDF document text
    • http://thesei.com/In PDF document text
    • https://camerabentrenet.camerabentre.vn/ckfinder/userfiles/files/rirufelek.pdfIn PDF document text
    • https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613075ed32d0b---dufelozimumuw.pdfIn PDF document text
    • https://hobbypet.cz/files/file/39580741437.pdfIn PDF document text
    • https://xn--22ck6bdp5cach0mc23a.com/ckfinder/userfiles/files/37577711436.pdfIn PDF document text
    • http://alconsprom.ru/ckfinder/userfiles/files/79226817212.pdfIn PDF document text
    • http://iranjobex.com/cache/fck_files/file/pimarigodudapo.pdfIn PDF document text
    • http://garagehayashi.com/js/upload/files/bofokuvubesiv.pdfIn PDF document text
    • https://kovtec.pl/eurostyl/photos/file/xebabegonobakovajozobaled.pdfIn PDF document text
    • http://maryalo.com/userData/board/file/senerulerejapuribomaruf.pdfIn PDF document text
    • http://sigmabhp.pl/userfiles/file/71287646536.pdfIn PDF document text
    • http://espressobuilders.com/app/webroot/files/userfiles/files/zisudevaboferuwobunaniw.pdfIn PDF document text
    • http://dongzzang.com/userfiles/file///xukotadugubixudakazuse.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6AA 18608 bytes
SHA-256: 218f416b2049e12380b2d4f47d687ab47385740e9cf78bd217b9167f0a973267
font_01_sfnt_off000106ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106EF 9844 bytes
SHA-256: 12c3e092d0a001757ad208071706dab344c5347c5baebb64ff868b89c89ffb84

Open this report in the interactive analyzer, or submit your own file for analysis.