PDF malware analysis — malicious · 845900681765ef91

MALICIOUS

PDF

84.8 KB Created: 2021-09-19 13:02:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23

MD5: 1a193fb969d11ed4865278aad690967b SHA-1: c1282d00798b507af7093a09f5111fdd11e93d0f SHA-256: 845900681765ef91f3a349142fa49a4df78b3748424d0e333ec91690b631a4db

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample was detected by ClamAV as Pdf.Phishing.Trojan. It contains numerous embedded URLs, many of which point to PDF files hosted on various domains, suggesting a link farm or redirection mechanism. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates a pattern of using disposable hosting for a large number of distinct links, which is common in phishing campaigns.

Machine Learning

Nyx PDF Classifier clean score 0.0591

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://war-old.its.vn/new/userfiles/file/zobibomixavitalujelom.pdf In PDF document text
- http://www.juniorcollege.cl/ckfinder/userfiles/files/xemuvedov.pdfIn PDF document text
- http://falconartistmanagement.com/ckfinder/userfiles/files/63166494692.pdfIn PDF document text
- https://www.stnedu.com/ckfinder/upload/files/ronuropolutunaxijux.pdfIn PDF document text
- https://iieng.org/editor/ckfinder/userfiles/files/muxelemotes.pdfIn PDF document text
- http://school19-zav.ru/userfiles/file/lukepurukutamugetofanuk.pdfIn PDF document text
- http://truhlarstvisollner.cz/data/file/sajopiwupubufujavox.pdfIn PDF document text
- http://explosivedevices.ru/media/file/47685221184.pdfIn PDF document text
- http://feg.vn/uploads/files/xalurolulo.pdfIn PDF document text
- http://xn--80aaaaadfwa5aftjhxrkcrg8iwc.xn--p1ai/pict/file/33947136651.pdfIn PDF document text
- https://indoshaolinkungfusociety.com/ckfinder/userfiles/files/surinarabemuwaful.pdfIn PDF document text
- http://wonderful-foods.net/userfiles/file/wuwetegezururosodipoxumo.pdfIn PDF document text
- http://evo-models.com/uploads/userfiles/files/pefawipasuka.pdfIn PDF document text
- https://wonwon.taipei/photo/file/96538552733.pdfIn PDF document text
- http://dachastyle.com/userfiles/file/tobuxurunokufekijetid.pdfIn PDF document text
- http://uklearningnetwork.com/userfiles/file/13133605870.pdfIn PDF document text
- https://satbietthu.com/luutru/files/45002257717.pdfIn PDF document text
- http://probeg2000.ru/files/userfiles/files/tupokemaruta.pdfIn PDF document text
- http://connectcontrol.net/files/userfiles/files/56832129139.pdfIn PDF document text
- http://asremajazi.com/uploads/files/loruratonoxolaxegezip.pdfIn PDF document text
- http://dezmaster.com/userfiles/file/pupawezajipovabejevufo.pdfIn PDF document text
- https://vnjhanoi.com/upload/files/86198073604.pdfIn PDF document text
- https://www.comperat-89.fr/ckfinder/userfiles/files/34150665781.pdfIn PDF document text
- https://4of100churchstreet.com/assets/media/files/42716513642.pdfIn PDF document text
- http://tvoirostov.ru/ckfinder/userfiles/files/wemolevudobubavoluxuze.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=racing+3d+speed+real+tracks+mod+apkPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d291.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD291	20252 bytes
SHA-256: `7e3116a98768d78da55607fccbe602a3333786eddbdce15067f285c33f34fd33`
`font_01_sfnt_off00010625.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10625	16232 bytes
SHA-256: `01cd0e4798e93fb086042d610f43ddeed7bf091af48aa863f5c4a4f61b651684`
`font_02_sfnt_off00011bff.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11BFF	11164 bytes
SHA-256: `b6fbccf61657d5a686dbd96d206f51300a30439958d652bc6a872aaa450191a4`
`font_03_sfnt_off000135ec.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x135EC	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.