Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac594a5ac2802695…

MALICIOUS

PDF

78.1 KB Created: 2021-10-11 11:59:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: 1f3577acddf360b4dcd047a28c22dfee SHA-1: 7bbd7ef0ddfb876502e3c7322259bc5c133bb043 SHA-256: ac594a5ac2802695a7e60910f4e572cc6511d676fb818cbb0915a3929b451fa7
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs pointing to various domains, with a high heuristic score indicating malicious intent and ClamAV detection confirming it as a phishing trojan. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic suggests a link farm strategy, likely to obscure the true malicious destination or to distribute payloads. No scripts were extracted from this sample, but the structure and heuristics strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7455

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://demenagements-remond.fr/userfiles/file/20210923030601.pdf In PDF document text
    • https://textosl.com/upload/editor/file/lewoxisutata.pdfIn PDF document text
    • http://sportsclinicwest.ie/media/contents/file/nifef.pdfIn PDF document text
    • https://bedandbreakfastholten.nl/userfiles/file/mevevitamegevanix.pdfIn PDF document text
    • https://hr-serdahel.hu/images/file/zinoveko.pdfIn PDF document text
    • https://yunglin.com/uploadpic/files/41074430384.pdfIn PDF document text
    • http://cannamelis.com/userfiles/file/nupelejikilik.pdfIn PDF document text
    • http://jiangsutravel.kr/userfiles/files/20210929_172300.pdfIn PDF document text
    • http://stylowa-pss.pl/userfiles/file/18932899375.pdfIn PDF document text
    • https://oklogistic.lv/upload/file/lowixerogelenevevegi.pdfIn PDF document text
    • http://atthaya.com/file_media/file_image/file/tilovofewonetiximikup.pdfIn PDF document text
    • http://hitechdentalhouston.com/uploads/files/83063266228.pdfIn PDF document text
    • https://marblo.com/app/webroot/img/files/27428649137.pdfIn PDF document text
    • http://holdemigny.fr/ckfinder/userfiles/files/rujulotexomorazupipa.pdfIn PDF document text
    • https://associazionebriciole.it/public/file/sodud.pdfIn PDF document text
    • https://embassyinvietnam.com/webroot/img/files/gexutamoletetugumifo.pdfIn PDF document text
    • http://asdgolfclubtoscana.com/writable/public/userfiles/file/dufejegajefow.pdfIn PDF document text
    • http://esistore.com/userfiles/file/fonekipojodorofanisivozi.pdfIn PDF document text
    • http://popnmusic.fr/userfiles/file/lufumevirabenudavitixufa.pdfIn PDF document text
    • http://hide-bo.com/img/tmp/file/58322980582.pdfIn PDF document text
    • http://feedproxy.google.com/~r/MbOu/~3/TSvcnjQ06Jg/uplcv?utm_term=brooklands+park+worthingPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC24 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00010436.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10436 20608 bytes
SHA-256: 46c19bb7c1a698cc1b83679f428ee89cb46e9124bf48e650c2567ac13ba70ce7

Open this report in the interactive analyzer, or submit your own file for analysis.