Malicious PDF — malware analysis report

Static analysis result for SHA-256 9438a28fc7ba4a0e…

MALICIOUS

PDF

73.5 KB Created: 2021-04-06 01:58:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 16bb7ad76ae1cc8932affa6cdb3401dc SHA-1: 9ab67839f23a2dd1dc6ab5515815c0915b8a3f85 SHA-256: 9438a28fc7ba4a0e9a2f81a889ce25a53f3f2740b51a6d6dd6c5455facbe06d4
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. It contains numerous embedded URLs pointing to external domains, suggesting it functions as a lure to phishing or malware download sites. The PDF structure and embedded links are characteristic of a link farm used to obscure the final malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8702

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=car+sales+manager+resume+pdf PDF link annotation
    • http://sasegotib.medianewsonline.com/verb_noun_adjective_adverb_table.pdfIn PDF document text
    • http://sokegex.mywebcommunity.org/1456857085.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4443814/normal_6004cc8608cee.pdfIn PDF document text
    • http://luxuwum.mypressonline.com/roxawi.pdfIn PDF document text
    • https://cdn.sqhk.co/zimamoko/njchaIJ/blank_2019_year_calendar.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391314/normal_5fdc5a31c908a.pdfIn PDF document text
    • https://cdn.sqhk.co/wanoposuj/hfjffgf/final_fantasy_xiv_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410030/normal_60107a80e1941.pdfIn PDF document text
    • http://nedavupagisezim.mygamesonline.org/gofevifuguvuvu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413125/normal_60389239939b3.pdfIn PDF document text
    • http://dosijefa.mypressonline.com/netoketumobekobexek.pdfIn PDF document text
    • https://cdn.sqhk.co/letinumi/Kif5gcD/spinner_io_beyblade.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4447436/normal_6001f553b44d6.pdfIn PDF document text
    • https://cdn.sqhk.co/rarinuva/coDgeyW/kilepedetabalekok.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496853/normal_6064c2a73850b.pdfIn PDF document text
    • http://fesalasan.mygamesonline.org/employee_provident_fund_scheme.pdfIn PDF document text
    • http://finomimetafix.sportsontheweb.net/amoeba_sisters_meiosis_worksheet_answer_key.pdfIn PDF document text
    • https://cdn.sqhk.co/nilimijano/ghCGH9G/crossword_puzzle_maker_edhelper.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e97e27d5-9078-458a-9b80-621574109fe7/97332730840.pdfIn PDF document text
    • http://vuxebezedigelun.onlinewebshop.net/duxetese.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6308b12-095c-4f32-9ad1-fb532573e6e8/setutufelawiner.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B78 5028 bytes
SHA-256: e2d6e733733817c08c1d2b27ee97a10f826f24dbc916a50072cc74464ecf949c

Open this report in the interactive analyzer, or submit your own file for analysis.