PDF malware analysis — malicious · 9235f4b594d56cea

MALICIOUS

PDF

52.6 KB Created: 2021-09-19 20:51:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12

MD5: 70f8af3c8fa11ba0ecb643a095f546a4 SHA-1: 200097c62e409226dd5873fc988ff68eb692b78e SHA-256: 9235f4b594d56cea0c33e8d013e5aefe1fad37132bd4361de79e72b921995b3c

132 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, which is a common technique for executing malicious code within documents. The ML classifier and ClamAV detection strongly indicate malicious intent. The PDF is also identified as a link farm, suggesting it's designed to redirect users to potentially harmful websites, likely for phishing or further malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.6927

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://badischer-kunstverein.de/ckfinder/userfiles/files/83957685018.pdf In PDF document text
- http://bjdfszwy.com/filespath/files/20210907140426.pdfIn PDF document text
- http://abwhopewell.com/uploads/files/70620746224.pdfIn PDF document text
- http://bridgeonlaw.com/filespath/files/20210907084855.pdfIn PDF document text
- https://rajnnuhiddje.se/userfiles/file/zawexamuwotuwofomog.pdfIn PDF document text
- http://mmprogetti.it/userfiles/files/40536979068.pdfIn PDF document text
- https://privatecambodiatour.com/userfiles/file/jexufodezajoxisesovulafof.pdfIn PDF document text
- http://designgaleria.hu/userfiles/file/mogona.pdfIn PDF document text
- https://swaarm.de/app/webroot/upload/files/35099062802.pdfIn PDF document text
- https://diarch.in/WYSIWYGImage/file/73473919498.pdfIn PDF document text
- http://zhihepvb.com/upload/ckimg/files/202109141402379990.pdfIn PDF document text
- http://nyitotthetvege.kastelyszallodak.hu/userfiles/files/1987538006.pdfIn PDF document text
- https://webhosting4.net/media/file/46960092108.pdfIn PDF document text
- http://garagehayashi.com/js/upload/files/dinig.pdfIn PDF document text
- https://www.bankkartya.hu/js/ckfinder/userfiles/files/52493558086.pdfIn PDF document text
- http://xz-brand.com/ckfinder/userfiles/files/91459440350.pdfIn PDF document text
- https://miltonmattox.com/userfiles/file/36444212134.pdfIn PDF document text
- http://fruitvita.com/files/files/45502613364.pdfIn PDF document text
- http://deforma.it/userfiles/files/20102006534.pdfIn PDF document text
- https://nsck-cykelmotion.dk/ckfinder/userfiles/files/rulibixodinefasiwuzopemap.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/zMnd8XtcwSM/uplcv?utm_term=unlock+andromax+m3zPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.