Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f3d15f8d221c102…

MALICIOUS

PDF

82.9 KB Created: 2021-09-19 08:16:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: 9669e0686adef9144c39fde3fb0d7b3d SHA-1: cfc90fb0e0e5d331bd071fdf9ab4e45deabdd3f8 SHA-256: 9f3d15f8d221c1029288562bca226b69f12eac02dc9c5b2947e8fbce426d45a4
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript and numerous external URIs, many pointing to disposable hosting, indicative of a link farm. The ClamAV detection 'Pdf.Phishing.Trojan-d2568dad23a94d95-10044375-0' strongly suggests a phishing or trojanized document. The embedded JavaScript likely facilitates the redirection to these malicious sites, potentially for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3358

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://clubberia.com/js/ckfinder/userfiles/files/42814980869.pdf In PDF document text
    • http://lexus-custom.com/js/upload/files/bologulemi.pdfIn PDF document text
    • http://mini-garden.ru/userfiles/file/96698974477.pdfIn PDF document text
    • http://185.33.116.145/~acus01/upload/files/luwosozoj.pdfPDF link annotation
    • https://asiquim.com/ckfinder/userfiles/files/tunasaridejivodoxoxujavi.pdfIn PDF document text
    • http://abimobiliare.pl/pliki/File/poletagezezivoworopofufa.pdfIn PDF document text
    • https://hgindustrial.eu/userfiles/files/26640814190.pdfIn PDF document text
    • http://nkmate.com/FileData/ckfinder/files/20210914_608CDE7C0B0FFB08.pdfIn PDF document text
    • http://mixmarketing.vn/upload/fck/file/lirogilezetogumubosi.pdfIn PDF document text
    • http://nature-revive.org/files/file/tevotalureti.pdfIn PDF document text
    • http://hoaiduc.edu.vn/ckfinder/userfiles/files/77065226486.pdfIn PDF document text
    • http://grapes4u.ca/sites/all/sites/grapes4u.ca/files/bovoruzotorimavazunaf.pdfIn PDF document text
    • http://conganbacgiang.vn/app/webroot/uploads/files/45352735526.pdfIn PDF document text
    • http://tomboy2.com/images/library/File/xukubekofa.pdfIn PDF document text
    • https://vocembalo.ch/userfiles/file/37969578649.pdfIn PDF document text
    • http://www.ettermanenterprises.com/ckfinder/userfiles/files/76848234141.pdfIn PDF document text
    • http://daugiavanthienphuoc.com/media/ftp/file/kipawog.pdfIn PDF document text
    • http://drapa-technika.cz/UserFiles/File/52513998643.pdfIn PDF document text
    • http://bangladeshceramicsociety.com/uploads/editor/files/wariduvofi.pdfIn PDF document text
    • http://phutunggiahungoto.com/uploads/files/faxevagibijaneri.pdfIn PDF document text
    • https://alkoplast.rs/files/bemapimuwer.pdfIn PDF document text
    • http://kiajihlava.cz/UserFiles/File/ponebip.pdfIn PDF document text
    • http://qdxqw.com/uploadfile/file/85974080889.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=android+adventure+games+2020PDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f65c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF65C 10936 bytes
SHA-256: da8ee054f00314d081e0d2642aeaf2c58fea02adf8e7e50a73695d1f4ad012da
font_01_sfnt_off00010f94.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F94 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.