Malicious PDF — malware analysis report

Static analysis result for SHA-256 8fac9666e9fcffe7…

MALICIOUS

PDF

74.8 KB Created: 2021-09-17 19:58:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: 01ce16d1eb545f6a2cd053b1830c9add SHA-1: 0f6a90d237d164a923e0147920676462e810c712 SHA-256: 8fac9666e9fcffe7e420ef4242b237bd0b6e2712a65cd4ed24184db4a1671bd2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF containing embedded JavaScript and multiple external URIs, flagged by ML and ClamAV as malicious. The heuristic 'SE_CALLBACK_LURE' indicates the document's content is designed to trick users into calling a phone number, a common tactic in phishing and tech-support scams. The presence of embedded JavaScript suggests an attempt to execute malicious code, likely to facilitate the callback lure or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9827

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ecogestval.com/userfiles/file/punoxizexiwijezago.pdf In PDF document text
    • http://kkc1.org/htdocs/cljr/data/files/31303823548.pdfIn PDF document text
    • http://www.nisbd.com/wp-content/plugins/formcraft/file-upload/server/content/files/16141fafcf0af0---kogejamikegitomeran.pdfIn PDF document text
    • https://msvadba.ru/files/file/feparotetenabisojurozidi.pdfIn PDF document text
    • https://777mto.org/contents/files/71641976696.pdfIn PDF document text
    • https://retake.dk/ckfinder/userfiles/files/94491927675.pdfIn PDF document text
    • http://rainternacional.com/userfiles/file/leteje.pdfIn PDF document text
    • http://mlsy.cz/images/file/files/dovagutuguz.pdfIn PDF document text
    • http://shesob.com/file/files/59966287934.pdfIn PDF document text
    • https://free-spirit-city.eu/uploads/wysiwyg/files/70997133907.pdfIn PDF document text
    • https://augsburger-dartliga.de/uploads/file/fuwususip.pdfIn PDF document text
    • http://bularz-auto.pl/images/userfiles/file/fabuguwojumonozevogobuv.pdfIn PDF document text
    • https://rumusjitu.com/contents/files/fuwoxizezibiwefedoxofex.pdfIn PDF document text
    • http://peoplefoster.com/pliki/18762056122.pdfIn PDF document text
    • http://thetestmag.com/userfiles/files/52054397317.pdfIn PDF document text
    • http://1yunnan.com/ckfinder/userfiles/files/ritofexugefitivisodelu.pdfIn PDF document text
    • http://www.deco-interieure.com/userfiles/file/xazejinifujosejawova.pdfIn PDF document text
    • https://fmpride.com/wp-content/plugins/super-forms/uploads/php/files/9f7d9e01aa4458f7ee28a6aa15d4de2c/sidijar.pdfIn PDF document text
    • https://gionggiacam.com/ckfinder/userfiles/files/dixogadofip.pdfIn PDF document text
    • http://avvocatogiuliani.it/userfiles/files/godazupulom.pdfIn PDF document text
    • https://organicearthfiji.com/documents/file/1902975745.pdfIn PDF document text
    • http://lobi.md/userfiles/file/70800248043.pdfIn PDF document text
    • https://markyatirim.com/resimler/files/fixawelofusubitabo.pdfIn PDF document text
    • http://winhazel.com/indigo/ckfinder/userfiles/files/waviruxuw.pdfIn PDF document text
    • http://computerdoki.hu/user/file/49649490235.pdfIn PDF document text
    • http://to-kajihan.net/js/upload/files/pumipodagifozirolajiz.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=apk+one+securityPDF link annotation
    • https://unimedbelem.com.br/painel_template/assets/global/plugins/ckfinder/userfilesfiles/47785599163.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c0d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC0D8 10444 bytes
SHA-256: 2b44efd4e4d1f31b8e89758bf484f206ed2e13a059549ef31d84cf53167a155b
font_01_sfnt_off0000d8c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8C7 17232 bytes
SHA-256: 2a534a6c5a50c3347bcd851f6766d2c56d4f159b6fde6febc5e1b17b198297c3
font_02_sfnt_off000105cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105CF 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.