Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8093bab34edafaa…

MALICIOUS

PDF

77.9 KB Created: 2021-09-23 11:19:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 271784866adff84fbbc45e42c77ded5c SHA-1: c9800179c0cae42c443a98f9b4a7f8ddd1541407 SHA-256: c8093bab34edafaa616a3a9518310f83718ea9afbce8b7bd562eb2ceb1195868
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and multiple external URIs, indicating an attempt to redirect the user to malicious sites. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggests this PDF is part of a link farm designed to host a large number of disposable URLs, likely for phishing or malware distribution. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7162

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=roblox+brookhaven+new+houses PDF link annotation
    • https://tfnd.org/wp-content/plugins/super-forms/uploads/php/files/91cee6e8e18adc78578354425482b544/8533420353.pdfIn PDF document text
    • http://webinaris.net/ckfinder/userfiles/publics/files/gisutebubivog.pdfIn PDF document text
    • http://self119.net/upload/userfiles/2021/09/files/210910162526.pdfIn PDF document text
    • https://moveo-sport.pl/userfiles/file/5201016173.pdfIn PDF document text
    • https://xenang-mitsubishi.com/fckupload/file/66657717956.pdfIn PDF document text
    • https://actaviaserica.org/board/file/files/bakuboludo.pdfIn PDF document text
    • http://askort.pl/Upload/file/gaditexo.pdfIn PDF document text
    • https://lightupalife.org.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1614bda3e2156f---ropeboxomeginujawigi.pdfIn PDF document text
    • http://vodnik48.ru/content/file/97331913221.pdfIn PDF document text
    • http://cps-mbstu.edu.bd/app/webroot/js/ckfinder/userfiles/files/pimikatidane.pdfIn PDF document text
    • http://bukvoznaika.ru/ckfinder/userfiles/files/75263969106.pdfIn PDF document text
    • https://cpc-serbia.org/js/files/35329973464.pdfIn PDF document text
    • http://blossomtour.net/FileData/ckfinder/files/20210919_0E6EE1500BBDD18F.pdfIn PDF document text
    • http://kolkandkolkdesign.com/site/data/ws/files/venupoxuxunufilidofulem.pdfIn PDF document text
    • https://etest.vn/app/webroot/uploads/files/55746896988.pdfIn PDF document text
    • http://kochamsushi.pl/UserFiles/file/43996077082.pdfIn PDF document text
    • http://millionsdiscount.com/mo_images/files/10923301653.pdfIn PDF document text
    • http://bright-mineral.com/uploadfile/file/2021090215524441.pdfIn PDF document text
    • http://chothuexeninhbinh.net/data/dulieu/files/83099590886.pdfIn PDF document text
    • http://julianina.dk/upload/file/63379794426.pdfIn PDF document text
    • https://nodka.eu/ckeditor/ckfinder/userfiles/files/15337877572.pdfIn PDF document text
    • http://www.herbertvanderbrugghen.nl/draft/47257562655.pdfIn PDF document text
    • http://jts-electrical.co.uk/ckfinder/userfiles/files/vubezasiritawixireroxufu.pdfIn PDF document text
    • http://newgrids.com/userfiles/file/mosikokuwajolazogis.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d489.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD489 18300 bytes
SHA-256: ff46165e83010822b21ba840d2d358fb0a750a0ff00f0210e6d756ca50bcea27
font_01_sfnt_off00010399.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10399 10644 bytes
SHA-256: 2bc8ac88a7dfbc509e5b74e704fc36d7946e2f70cbc48eceb44e86322103d771
font_02_sfnt_off00011c0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C0E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.