Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5128f83a465a5c9…

MALICIOUS

PDF

83.4 KB Created: 2021-09-19 20:45:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: f5608cc13d90b3a3dc6614a5a4dc14d3 SHA-1: cd7547e18412389e9f84c9394aa132104953df5c SHA-256: c5128f83a465a5c95dc7a2f19001434b2d2f9f0254f3313100a9d51124d1a039
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which point to PDFs hosted on various domains, suggesting a link farm designed to redirect users. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs indicate a potential for malicious redirection or content delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gmt-tw.com/app/webroot/userfiles/files/kuziw.pdf In PDF document text
    • http://we-women.de/default/files/uploads/file/popilox.pdfIn PDF document text
    • https://grupahatak.pl/admin/_fck_files/file/jowifosukekas.pdfIn PDF document text
    • https://pomacanthe-art.fr/imagebeforeafter/files/vojufopuxafumipifap.pdfIn PDF document text
    • http://kalikraft.com/images/file/58950364637.pdfIn PDF document text
    • http://geology.ie/wp-content/plugins/formcraft/file-upload/server/content/files/16146a0b763a67---17443463237.pdfIn PDF document text
    • http://santeh.md/img/files/butogomunujosukezigepo.pdfIn PDF document text
    • https://lee-trading.tw/archive/upload/files/4723946092.pdfIn PDF document text
    • https://ncltandatbar.com/home/ncltandat/public_html/dowalumniusa/ckfinder/userfiles/files/3758410040.pdfIn PDF document text
    • http://romangruszecki.com/uploaded/file/tixutaruvabi.pdfIn PDF document text
    • http://vkp.ru/upload/global/file/43537432329.pdfIn PDF document text
    • http://wadsoda.com/UserFiles/File/92252854054.pdfIn PDF document text
    • https://gdaniec.com/upload/files/gonawisoposofebir.pdfIn PDF document text
    • http://vlajkylevne.cz/UserFiles/File/labagivos.pdfIn PDF document text
    • http://inwallendorf.de/userfiles/file/58592836425.pdfIn PDF document text
    • https://lotusmarinevn.com/upload/files/zetifereguxapofojopobuzad.pdfIn PDF document text
    • http://wedding-box100.com/uploads/files/202109090728355269.pdfIn PDF document text
    • http://gzlmjx.com/data/home/bxu2343160066/htdocs/uploadfile/files/43105653164.pdfIn PDF document text
    • http://thucphamchucnangmy.vn/uploads/files/76526957957.pdfIn PDF document text
    • http://rydelko.pl/userfiles/file/74391091891.pdfIn PDF document text
    • http://one9five.com/userfiles/files/jazureluvetewurave.pdfIn PDF document text
    • http://studioboscono.it/userfiles/files/59910924383.pdfIn PDF document text
    • https://soenen-pneus.com/upload/file/79961881949.pdfIn PDF document text
    • http://xn--80aikni6a0b.xn--p1ai/images/file/xalevuvozogexusem.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=watch+skam+online+free+english+subtitlesPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc06.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC06 19156 bytes
SHA-256: 2657a861f5561ec67ba4f8b3e3934ad006a9f3b7e381ac393b636d9c1a12c356
font_01_sfnt_off00010dc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DC7 11108 bytes
SHA-256: 0f3a35c31dcf680debf7dafb4716a5e8ea2ae943e2883e6552a70ed0eb8d441f
font_02_sfnt_off00012788.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12788 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.