Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3145f6da4a1837a…

MALICIOUS

PDF

65.1 KB Created: 2021-09-18 01:53:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: 49db6bf7a82e8a0f77c2de064f31b84f SHA-1: 95e3f50d07526cbb1cbf982b9415ee26f01da5a4 SHA-256: a3145f6da4a1837a148027af3788aad880d7341020bbdc8d444da97909c61cff
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it functions as a link farm, containing a high number of external URIs pointing to various domains. This suggests the document's primary purpose is to redirect users to potentially malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7082

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mountainbrookbuilders.com/home/mountain/public_html/ckfinder/userfiles/files/dopotezojadasabo.pdf In PDF document text
    • http://kondicionery-fryazino.ru/upload_picture/file/21176989928.pdfIn PDF document text
    • http://fukaofoods.tw/uploads/files/202109131951062175.pdfIn PDF document text
    • http://hoteldarim.ir/basefile/hoteldarimir/files/dadamasewud.pdfIn PDF document text
    • http://dooroc.com/tk/upload/file/75485681321.pdfIn PDF document text
    • http://jmk.kr/ckfinder/userfiles/files/85244838296.pdfIn PDF document text
    • http://npxbyy.com/wang3_3_10_27/Upload/Upload/file/2021912247222221.pdfIn PDF document text
    • http://gilendor.cz/userfiles/file/lojor.pdfIn PDF document text
    • http://cpghollywood.com/userfiles/files/43097711203.pdfIn PDF document text
    • https://kstraders.com/userfiles/file/70733927839.pdfIn PDF document text
    • https://www.disbel.es/ckfinder/userfiles/files/lirezakes.pdfIn PDF document text
    • https://ncfouting.com/wp-content/plugins/formcraft/file-upload/server/content/files/161393dd2dae1a---vitomukotufuvudilosarem.pdfIn PDF document text
    • http://box8websites.com/ckfinder/userfiles/files/tenodivevafanepafepup.pdfIn PDF document text
    • http://terredellamagnagrecia.com/userfiles/files/xolivagukivowujizi.pdfIn PDF document text
    • http://studioesflores.pl/obrazy/file/36664349360.pdfIn PDF document text
    • http://inphilong.com/upload/files/59362306810.pdfIn PDF document text
    • https://rendszergazda-cegeknek.hu/ckfinder/userfiles/files/22442798686.pdfIn PDF document text
    • http://thietbidienmpe.net/upload/files/pidolidorekijikiraf.pdfIn PDF document text
    • http://busto-wl.gattinonimondodivacanze.it/themes/userfiles/files/36634841566.pdfIn PDF document text
    • http://matras-devison.com/upload/file/74219452786.pdfIn PDF document text
    • http://montesantangelo.it/files/files/10491505910.pdfIn PDF document text
    • http://www.appsolutely.sg/wp-content/plugins/formcraft/file-upload/server/content/files/16137ddee54a85---88221081419.pdfIn PDF document text
    • http://geriatriccarenewjersey.com/userfiles/files/rawipijefapulumime.pdfIn PDF document text
    • http://apmnir.ro/fckfiles/file/pojutuwizazebekidizu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=manuales+yo+no+abandono+pdfPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e156.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE156 10548 bytes
SHA-256: ee6a9b234c3922e87bbf487f463fc04886ab3f76607e91507262c2c20050eb5d

Open this report in the interactive analyzer, or submit your own file for analysis.