Malicious PDF — malware analysis report

Static analysis result for SHA-256 af406df0349123ba…

MALICIOUS

PDF

83.8 KB Created: 2021-09-24 02:10:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 9c98f794889eb0689689f7616e7e58bc SHA-1: ecb4dfda3a436b72eafaed14c8cc43a30255525c SHA-256: af406df0349123ba28f5e7f2f4c063038329729ff2830146d8ed07fee6c2c0e4
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for Pdf.Phishing.Trojan. The presence of numerous embedded URLs, many pointing to disposable domains and configured as a link farm, strongly suggests a phishing or malware distribution campaign. The ML classifier also indicated a high probability of maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5648

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://marinaxaraes.com.br/ckfinder/userfiles/files/miwotom.pdf In PDF document text
    • https://binarbaidservices.com/public_html/userfiles/file/zizadivajup.pdfIn PDF document text
    • https://event-connections.net/wp-content/plugins/formcraft/file-upload/server/content/files/1614cf6ca3fa04---65602557334.pdfIn PDF document text
    • http://2m-m.eu/userfiles/files/41027667475.pdfIn PDF document text
    • https://ikansambel.com/contents/files/65999685742.pdfIn PDF document text
    • https://vico-domrep.com/ckfinder/userfiles/files/73001688400.pdfIn PDF document text
    • http://knupress.com/pds/editor/file/57367745398.pdfIn PDF document text
    • http://verkaufs-akademie.com/userfiles/file/33825295307.pdfIn PDF document text
    • https://personalloan2u.com/wp-content/plugins/super-forms/uploads/php/files/bc7d5aa1bb782e0d235be2ff1fd98cb4/gimopimatoralolipataw.pdfIn PDF document text
    • http://moscow-vernisage.com/files/files/dexodab.pdfIn PDF document text
    • https://mekongtransport.com/upload/userfiles/files/1474106005.pdfIn PDF document text
    • http://ph-easycome.com/userfiles/file/taramakogeduvu.pdfIn PDF document text
    • https://amthanhanhsangchinhhang.vn/upload/files/19058907134.pdfIn PDF document text
    • https://shopexpert.com/app/webroot/files/userfiles/files/47589559494.pdfIn PDF document text
    • http://syntra.pl/userfiles/file/relaxonisovogeguvogowa.pdfIn PDF document text
    • http://srilakshmienterprises.net/uploads/natelidap.pdfIn PDF document text
    • https://tepatsasaran.com/contents/files/71619846715.pdfIn PDF document text
    • http://clanlogging.com/userfiles/file/wovapokukagifogatamu.pdfIn PDF document text
    • http://www.bluefashion.cz/ckfinder/userfiles/files/85146129311.pdfIn PDF document text
    • http://gld-lining.com/user_img/files/tebulite.pdfIn PDF document text
    • http://gokea.org/upload/editor/files/36268154685.pdfIn PDF document text
    • http://orzo.cz/uploaded/files/46084058474.pdfIn PDF document text
    • http://xn--k1akb4c.xn--p1ai/userfiles/file/tenataxifawuzupizunowono.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=wavelength+and+frequency+relationshipPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ae0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AE0 20148 bytes
SHA-256: 246c028ace28430c4b32c66b1d6cb9df9f7bcf259c96e288e56b4fb229bd4130

Open this report in the interactive analyzer, or submit your own file for analysis.