PDF malware analysis — malicious · a82d0802ded7f0d7

MALICIOUS

PDF

81.7 KB Created: 2021-09-11 18:44:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24

MD5: f678ad427c30611ae32a7b3349c31c6e SHA-1: e55ee4e91c74316d2049a2c7d10e0bd489f123b4 SHA-256: a82d0802ded7f0d7d1e36e6262793a487eb0f4d3427e323e604f633b2965f6b1

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it functions as a link farm, hosting numerous links to disposable domains, with one prominent URL pointing to synerhu.ru. The document body is unreadable, but the PDF structure and URL analysis strongly suggest a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.6964

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://synerhu.ru/uplcv?utm_term=explain+bronfenbrenner%27s+ecological+theory PDF link annotation
- https://healthlantern.com/ckeditor/ckfinder/userfiles/files/getifurazuvufaxijur.pdfIn PDF document text
- http://mateuszkucharski.pl/admin/file/jemuvevavonubo.pdfIn PDF document text
- https://www.babetravelling.com/ckfinder/userfiles2/files/87109719510.pdfIn PDF document text
- http://willettelaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/repubetelenosazikevarezo.pdfIn PDF document text
- https://eltonltd.ru/sites/default/files/uploads/86132924540.pdfIn PDF document text
- http://zit-tech.com/userfiles/files/xuzikajaduwukupig.pdfIn PDF document text
- https://verticala.ro/images/userfiles/beboxesuriga.pdfIn PDF document text
- http://kodemari.info/data/files/kekuluvemelevuriw.pdfIn PDF document text
- https://flyags.com/editorResources/file///fumavatuzonujedobezas.pdfIn PDF document text
- https://howardsteeves.com/wp-content/plugins/super-forms/uploads/php/files/8365858d0e7e5367f51c7ab251c193f4/pituza.pdfIn PDF document text
- http://multiseal.com.ph/wp-content/plugins/formcraft/file-upload/server/content/files/16136f6797ca47---fizidijafizipoju.pdfIn PDF document text
- http://ptsound.com/plugins/ckfinder/userfiles/files/14046309225.pdfIn PDF document text
- http://acudrved.com/ckfinder/userfiles/files/koromanusevejojusoke.pdfIn PDF document text
- http://www.psoealora.es/ckfinder/userfiles/files/64602252611.pdfIn PDF document text
- http://phulieumaymacbaoco.com/hinhanh_fckeditor/file/lokajapu.pdfIn PDF document text
- http://abwvictory.com/uploads/files/nutabipu.pdfIn PDF document text
- http://syarmarka.ru/userfiles/files/lifularerisupolozukej.pdfIn PDF document text
- https://datatalk.ilvzhou.com/upload/files/2021/09/202109061716312632.pdfIn PDF document text
- https://treasurehunterdetectors.solar-ovens.net/ckfinder/userfiles/files/votorinoxezafisiretofud.pdfIn PDF document text
- http://daiduongmetal.com/uploads/ckfinder/files/rusuzuzake.pdfIn PDF document text
- http://safeabortionnepal.com/userfiles/file/24497924922.pdfIn PDF document text
- http://canvangdientu.com/images/file/sepeliwara.pdfIn PDF document text
- https://burgaseguros.com/userfiles/file/53667295528.pdfIn PDF document text
- http://forum-auto.ru/data/files/zewiwiditexozona.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e5aa.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE5AA	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000fdbc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFDBC	19124 bytes
SHA-256: `673df9bff3394f14adbca84f47468eeae788d5aa21aa7d6f5be4d47ac7e08bd2`
`font_02_sfnt_off00012fbb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12FBB	11132 bytes
SHA-256: `79802dacf41fdf236342e24fa7dbecec7f3331df4823fb085bdc24dd9459cf02`

Open this report in the interactive analyzer, or submit your own file for analysis.