Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f1b09d33ac6963a…

MALICIOUS

PDF

62.3 KB Created: 2021-09-27 16:11:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: aeb166f36ce31397f36858c7852ce5ef SHA-1: ff9fe9c664c09d7b622305cc857d7e30d45cf701 SHA-256: 8f1b09d33ac6963ae647219d66d65cd5dc5be5a2c0d0edc24330bca3fe5c54f7
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs pointing to disposable domains, characteristic of a link farm used for phishing or distributing further malware. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically flags this behavior, suggesting the document's primary purpose is to redirect users to potentially harmful external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6508

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=not+enough+space+to+create+userdata+partition+android+studio PDF link annotation
    • http://www.hz-kontejnery.cz/ckfinder/userfiles/files/godutunafilikak.pdfIn PDF document text
    • http://93564497.com/userfiles/11054126895.pdfIn PDF document text
    • https://stabiactiv.com/userfiles/file/mufofamenulenubodet.pdfIn PDF document text
    • http://dogalakustik.com/depo/sayfaresim/file/40582898907.pdfIn PDF document text
    • https://clifestyle.net/uploades/userfiles/file/gexipibadoris.pdfIn PDF document text
    • http://hevolta.com/upload/file/veribamavelujegorojisef.pdfIn PDF document text
    • https://cooperadora.grupocreartel.com/documentos/archivos/98224777995.pdfIn PDF document text
    • http://kyochonbuenapark.iorderfoods.com/uploads/files/931676194.pdfIn PDF document text
    • http://webbyshoe.com/fckeditor/userfiles/file/69791076763.pdfIn PDF document text
    • http://exosportsante.fr/ckfinder/userfiles/files/zumitirekadar.pdfIn PDF document text
    • http://ddservice-bmw.pl/userfiles/file/79134524488.pdfIn PDF document text
    • http://dlshixiang.com.cn/ckfinder/userfiles/files/30388872864.pdfIn PDF document text
    • http://smartickgroup.com/userfiles/jojadokopunonutolemujeso.pdfIn PDF document text
    • http://datcat.vn/2018/file/46634882934.pdfIn PDF document text
    • http://upservice.expert/admin/ckfinder/userfiles/files/12988598290.pdfIn PDF document text
    • https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/161423be3dc6b3---muzevijad.pdfIn PDF document text
    • https://www.kadinlarsitesi.org/wp-content/plugins/formcraft/file-upload/server/content/files/1614b618aa0ec4---4868664539.pdfIn PDF document text
    • http://ychnjl.net/userfiles/files/72961088873.pdfIn PDF document text
    • https://plagij.at/ckfinder/userfiles/files/pizenovesezuxedojadimifa.pdfIn PDF document text
    • https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/161510d1413f10---57862512595.pdfIn PDF document text
    • http://iscelenie.info/files/file/kuwezixelolibajijesakenak.pdfIn PDF document text
    • http://modernplating.com/userfiles/file/pefagogalexi.pdfIn PDF document text
    • http://tractortools.cz/ckfinder/userfiles/files/wojipipo.pdfIn PDF document text
    • http://sherwoodchambergolf.org/ckfinder/userfiles/files/kubajarofewajuxis.pdfIn PDF document text
    • http://xsjsbzrw.com/uploads/files/filogivilofitina.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b0fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB0FA 16128 bytes
SHA-256: aa15f04537a0e274c12c7e35cb9b02ca5b11790d5651efc3bb24444ebb693cbe
font_01_sfnt_off0000d9c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9C4 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.