Malicious PDF — malware analysis report

Static analysis result for SHA-256 90ae37c40ef5e855…

MALICIOUS

PDF

64.0 KB Created: 2021-10-04 15:47:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-31
MD5: 951b3553cc02c67a2118d0a5667b2259 SHA-1: 1e5b26edec176ed4f14fbdead4a16d0d7fdc920c SHA-256: 90ae37c40ef5e85572ddc658fdcd8e7a6ee8438ca33fdc867a0b41befc1f650c
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous embedded URLs, many of which point to disposable hosting and are structured as link farms, a common tactic for phishing or distributing further malware. The `PDF_SEO_DISPOSABLE_LINK_FARM` heuristic specifically flags this behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9203

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://archism.ru/uplcv?utm_term=definition+of+stress+and+strain+in+mechanical+engineering PDF link annotation
    • http://clinicaveterinariabilancino.it/userfiles/files/xamugawagiguvarabawe.pdfIn PDF document text
    • http://murielbellhomes.com/userfiles/files/29417273289.pdfIn PDF document text
    • http://rioairporttransfer.com/ckfinder/userfiles/files/95591950872.pdfIn PDF document text
    • https://sibservis.com/ckfinder/userfiles/files/2467936434.pdfIn PDF document text
    • http://ventss.ru/userfiles/files/gugevosoxiredovusegij.pdfIn PDF document text
    • http://sriraghavendratemple.com/ckfinder/userfiles/files/fefisoxazaw.pdfIn PDF document text
    • http://hongdanhaudio.com/luutru/files/80353820057.pdfIn PDF document text
    • http://www.aunay-sous-auneau.fr/ckfinder/userfiles/files/judogibo.pdfIn PDF document text
    • http://diamant-x.sk/UserFiles/file/nanivomibokapipiwuwefasos.pdfIn PDF document text
    • http://sprinter-lab.ru/content/File/febowovibefosulef.pdfIn PDF document text
    • http://recviem.ru/img/upload/75068241.pdfIn PDF document text
    • http://fohow77.ru/upload/file/15015758446.pdfIn PDF document text
    • https://aeternoplanning.com/ckfinder/userfiles/files/1700601492.pdfIn PDF document text
    • http://palirna-frydek.cz/uploaded/file/66690500143.pdfIn PDF document text
    • https://alicantea.centralcms.cloud/galeria/files/muxuwetosez.pdfIn PDF document text
    • http://pfollowers.com/ci/userfiles/files/fopaxanike.pdfIn PDF document text
    • http://ingmontagna.com/userfiles/files/gewemigolivure.pdfIn PDF document text
    • http://maryalo.com/userData/board/file/patadurabuzif.pdfIn PDF document text
    • http://xn----itbbfrdrdbd4bgy6gi.xn--p1ai/webroot/files/files/belolodaterilikar.pdfIn PDF document text
    • https://detectiveoffice.net/userfiles/file/turetoroxudajemitufaz.pdfIn PDF document text
    • http://tnmetalworks.com/images/files/wedusajagizit.pdfIn PDF document text
    • http://bora.su/ckfinder/userfiles/files/xeribawiriz.pdfIn PDF document text
    • http://aroma-es.site/yamituki-n/uploads/files/xusepizetoj.pdfIn PDF document text
    • http://petswithlove.com/cvsprojects/SSK/Source/2.0.0/images/files/88548209339.pdfIn PDF document text
    • http://ganteltechnology.com/system/userfiles/file/dunuvesabugamap.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0AF 10924 bytes
SHA-256: 97f6a773cbbbcb2582c8a5ea2e4a4f3b25dcd35e0a8c7a6eaecbf4beec04c486

Open this report in the interactive analyzer, or submit your own file for analysis.