Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf58e3269f0ce4d3…

MALICIOUS

PDF

47.6 KB Created: 2021-09-25 00:17:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 112c3d948e393103b77c1bb1e2d9cd5f SHA-1: fbd97dcde7be9c49f4c56d8b64366acfbdbf2829 SHA-256: bf58e3269f0ce4d3f3efa315d15393ff7d82475c5c2c949bc577600d4058daf4
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and is identified as a link farm with numerous external URIs, indicating a malicious intent to redirect users. ClamAV detection and ML classification further support its malicious nature, likely as a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7892

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lookupagency.es/wp-content/plugins/formcraft/file-upload/server/content/files/16132f71b6cf05---kosopifusebexolug.pdf
    • http://dentalcenterstudio.it/userfiles/files/nebaxewugakoxozal.pdf
    • http://mcserpenti.com/userfiles/file/92465578028.pdf
    • http://www.octopus-quatuorvocal.com/ckfinder/userfiles/files/baxedivewujor.pdf
    • http://upnbkk.com/file_media/file_image/file/41336175175.pdf
    • http://cserepakcio.hu/xdata/file/lejipetomemetig.pdf
    • http://ourconn.com/userfiles/file/202109012141452181.pdf
    • http://baikalspring.ru/ckfinder/userfiles/files/38670419192.pdf
    • http://paintmaster.hu/js/ckfinder/userfiles/files/zilabodif.pdf
    • http://kerekesvillszer.hu/UserFiles/file/10770213584.pdf
    • http://nhasachnguyenvancu.com/Images_upload/files/gupebesapesitap.pdf
    • http://soosanfix.com/upload/fckeditor/file/77039320151.pdf
    • http://xn--12cbg9dihj7egda2g6a7dceb1d2cp4nvgf4f.com/datas/files/80845407844.pdf
    • https://073741256.com/uploads/files/202109241337347849.pdf
    • http://logtech.cz/foto/Image/file/84985226465.pdf
    • http://tetraeng.it/userfiles/files/79045571077.pdf
    • http://bangtutrang.com/upload/files/mijalanus.pdf
    • http://www.patricktennis.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1614bad9b884dc---ruwokekuze.pdf
    • http://evolutionchonburi.com/userfiles/files/19592232740.pdf
    • http://the-bom.kr/upfile/files/980344759.pdf
    • http://wu-pao.com/upfiles/editor/files/nederegadimajo.pdf
    • https://dycmc.com/DATA/upload/files/202109011419065018.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=what+to+do+with+too+many+courgettes

Open this report in the interactive analyzer, or submit your own file for analysis.