Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8b12ba4c099f945…

MALICIOUS

PDF

63.8 KB Created: 2021-09-24 05:02:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: d13988202b1ef112f22b107e562bb9dc SHA-1: 2e88ad64a154c4350c5a0d0853579fe6bae0a65b SHA-256: a8b12ba4c099f9459d55768134b89e0945e1cc80e282a83bb65292c2e9e85101
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for Pdf.Phishing.Trojan and an ML classifier indicating maliciousness. The presence of numerous embedded URLs, many pointing to potentially disposable domains, suggests a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and heuristic firings strongly indicate malicious intent, likely related to spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7082

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://rosebankprimary.co.za/inc/ckfinder/userfiles/files/juwoweditulomipokafamogab.pdf In PDF document text
    • https://bayihoki99.com/contents/files/kudoku.pdfIn PDF document text
    • http://sanarina-coaching.de/ckfinder/userfiles/files/53290845733.pdfIn PDF document text
    • http://thebodyclubonline.com/userfiles/file/mijefefupiviro.pdfIn PDF document text
    • https://essuances.com/ckfinder/userfiles/files/49445743982.pdfIn PDF document text
    • https://rintrans.com/files/xofenagazomupil.pdfIn PDF document text
    • https://kolbandibileklik.com/resimler/files/kotez.pdfIn PDF document text
    • https://xn--80ag1a2a.xn--p1ai/files/file/likuzebexagofuruzuvugu.pdfIn PDF document text
    • https://desertflying.club/wp-content/plugins/formcraft/file-upload/server/content/files/16131c4de96531---sililosawijixepagejav.pdfIn PDF document text
    • https://bandotrading.com/uploads/file/97460945334.pdfIn PDF document text
    • https://minjar.mebel18.com/uploads/files/jatejapog.pdfIn PDF document text
    • https://www.osteopathe-montpellier-sud.fr/ckfinder/userfiles/files/88531724149.pdfIn PDF document text
    • http://www.drivingschool-brno.cz/files/files/dixisojunug.pdfIn PDF document text
    • http://unsersohn.com/images/file/zujofu.pdfIn PDF document text
    • http://airelimpio.mx/img/editor/file/70491885995.pdfIn PDF document text
    • http://mkbeauty.vn/luutru/files/47202655837.pdfIn PDF document text
    • http://vncdata.net/app/webroot/uploads/files/14936770077.pdfIn PDF document text
    • http://newgrids.com/userfiles/file/1346234713.pdfIn PDF document text
    • https://nikolsbeauty.com/webroot/f/uploads/file/bumopesasatezukugon.pdfIn PDF document text
    • http://poorclarescork.ie/images/piwupafijerero.pdfIn PDF document text
    • https://tdfstore.it/file/36673554966.pdfIn PDF document text
    • https://medsplus.us/admin/images/file/risogoxuvozowabapukigopu.pdfIn PDF document text
    • https://skvely-kup.cz/files/file/14856567075.pdfIn PDF document text
    • http://studioarclab.eu/userfiles/files/75564990324.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=yeager+android+game+downloadPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3CB 10396 bytes
SHA-256: 701139717d09f649a8c235afb3a148605b6400acb767d3c4d460a45632e47b10

Open this report in the interactive analyzer, or submit your own file for analysis.