Malicious PDF — malware analysis report

Static analysis result for SHA-256 a00f66221d28e213…

MALICIOUS

PDF

62.3 KB Created: 2021-09-18 04:45:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: 974939b54c5cba37096c66a997633ad7 SHA-1: 22e9ac0a8af3f28316eee60e42ba6557cef1c87e SHA-256: a00f66221d28e2136217197382efeee435c6fdcf81818554dbd8dc83f87a4e58
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF file flagged by ML classifiers and ClamAV as malicious. It contains numerous embedded URLs, many of which point to disposable hosting and appear to be part of a link farm designed to redirect users. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggests a malicious intent to host or redirect to malicious content. No scripts were extracted, but the presence of numerous external URIs indicates a likely attempt to deliver further malicious content or phish for information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7090

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=accept+credit+cards+on+smartphone PDF link annotation
    • http://sirinthepgroup.com/userfiles/file/wumarobaxedixudatogu.pdfIn PDF document text
    • http://taigesw.com/upload/files/voluwoluze.pdfIn PDF document text
    • http://gramercy-grand.ru/files/file/72613370595.pdfIn PDF document text
    • http://opakowania-loga.pl/zdjecia/fotki/file/sipitopizanamabezu.pdfIn PDF document text
    • http://hmconcretemixingplant.ru/d/files/50910652791.pdfIn PDF document text
    • http://tsg-vaganovskoe.ru/ckfinder/userfiles/files/44719948885.pdfIn PDF document text
    • https://amoslodge10-org.alljobsinliberia.com/ckfinder/userfiles/files/51661718215.pdfIn PDF document text
    • https://mihalex.by/files/files/51335895590.pdfIn PDF document text
    • https://yastudio.net/wp-content/plugins/super-forms/uploads/php/files/e2d8d019558820ecd2aa8596ee0cdad3/gitaveri.pdfIn PDF document text
    • http://rdasesores.gestconcursal.com/editor/ckfinder/userfiles/files/45782816306.pdfIn PDF document text
    • https://pioneerlift.com/upfiles/editor/files/87594473014.pdfIn PDF document text
    • https://bakotech.at/uploads/ckeditor/files/58739743942.pdfIn PDF document text
    • http://zovsh.com/Uploadfiles/files/fesazisefepikuniwonedimo.pdfIn PDF document text
    • https://smshealthcareservices.com/ckfinder/userfiles/files/dolosulekados.pdfIn PDF document text
    • http://nhuaduongnhapkhauaz.org/upload/files/sofaladutuvide.pdfIn PDF document text
    • https://12shio3.com/contents/files/lupibakamogiwitulisojase.pdfIn PDF document text
    • http://strategie-online.net/catalogue_dynamique/file/sikozofebeg.pdfIn PDF document text
    • https://mayxaydungthienlong.com/uploads/files/files/vofimiropusa.pdfIn PDF document text
    • http://xn--80aantfcaehjbxzf1m.xn--p1ai/userfiles/file/35794249181.pdfIn PDF document text
    • https://yarpaket.ru/userfiles/file/51811355422.pdfIn PDF document text
    • http://imosa.asia/uploads/files/202109180346531177.pdfIn PDF document text
    • https://gedayapi.com/userfiles/file/19000935708.pdfIn PDF document text
    • https://brakos.it/file/moborujuzetipunili.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d895.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD895 10716 bytes
SHA-256: b1b5918937559538c305ba2c9bea86a797bffc736debd04bc28e96517f131146

Open this report in the interactive analyzer, or submit your own file for analysis.