Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9c6e8f894df2ee0…

MALICIOUS

PDF

78.1 KB Created: 2021-09-21 22:53:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 1973875ac34cd1109b927a081cbf2cdd SHA-1: 3be34273aaf35208fd4d08ad4881dfad130c286e SHA-256: a9c6e8f894df2ee0c8c1f00ca662c816664f2c7e01abf8f8d5a513ec2d9b4cfb
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document containing embedded JavaScript and a large number of external links, many of which point to disposable domains. The ClamAV detection 'Pdf.Phishing.Trojan' and the heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggest a phishing or malware distribution campaign. The embedded JavaScript likely facilitates the redirection or exploitation process.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3499

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gianniarnaudo.com/userfiles/files/pidofinorodomokure.pdf In PDF document text
    • https://miamiuniquelimo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16134462948c93---49016288397.pdfIn PDF document text
    • http://stimatacasa.eu/userfiles/files/73703757480.pdfIn PDF document text
    • https://nepalmicrofinancesummit.org/userfiles/files/6759880326.pdfIn PDF document text
    • http://metabolit-plus.ru/files/file/vufipo.pdfIn PDF document text
    • http://smenergy.kr/uploaded/file/155197756613bef35b7465.pdfIn PDF document text
    • http://manchetenewsms.com.br/ckfinder/userfiles/files/39384922668.pdfIn PDF document text
    • http://thepokewave.com/uploads/files/vufelusemawexepowu.pdfIn PDF document text
    • https://ymy-tea.tw/upload/files/37145669866.pdfIn PDF document text
    • http://zdravi-kromeriz.cz/files/file/43186200968.pdfIn PDF document text
    • http://metamorfoza-krosno.pl/userfiles/file/jovifabupisot.pdfIn PDF document text
    • http://nova-auto.com/upload/budovedazowivomowusepi.pdfIn PDF document text
    • http://apnschool.in/singhania/downloads/file/13045074317.pdfIn PDF document text
    • http://confidenzacsapagy.hu/upload/18806553289.pdfIn PDF document text
    • http://omni-links-europe.com/images/blog/file/botigijalugibiforin.pdfIn PDF document text
    • http://bowlingkillers.com/imgdb/files/benatob.pdfIn PDF document text
    • http://sushiyaslo.com/uploads/files/91384375286.pdfIn PDF document text
    • http://albarossa.jp/js/upload/files/59184618302.pdfIn PDF document text
    • https://mr-alian.com/upload/ckfinder/files/22988857275.pdfIn PDF document text
    • http://korsorlampang.net/user_img/files/wotopawopavuna.pdfIn PDF document text
    • http://posicert.com/upload_fck/file/2021-9-2/20210902121822183407.pdfIn PDF document text
    • http://paraglider24.de/pics/fotos/1/file/90197544780.pdfIn PDF document text
    • http://canphantich.net/Images_upload/files/pusoxadezawomi.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/A3Ryygt5BCM/uplcv?utm_term=hack+android+pokemon+go+2020PDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3D4 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000fbeb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBEB 10868 bytes
SHA-256: 961ea1982de3f00735c9986abdbb6e6de2960c865fd1fd4548675ac990907ad7

Open this report in the interactive analyzer, or submit your own file for analysis.