PDF malware analysis — malicious · cd9c6151337d180c

MALICIOUS

PDF

76.0 KB Created: 2021-09-21 20:31:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27

MD5: 5e26247540225f430434425a7c2cfb35 SHA-1: 661dd633407d1af472cb0b3f8b1f88553d2a9ca6 SHA-256: cd9c6151337d180c8c3e4ba14d77f22fbdd56f45a921854d3b267ff51091fe65

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was detected as a phishing trojan by ClamAV. It contains numerous embedded URLs, many of which point to disposable domains and are structured as link farms, indicating a potential phishing or malware distribution scheme. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggests this malicious intent. No scripts were extracted, but the presence of embedded URLs and the ClamAV detection point towards a malicious document.

Machine Learning

Nyx PDF Classifier suspicious score 0.3768

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://inbeeldt.nl/userfiles/file/puditafemezosopidatoz.pdf In PDF document text
- http://www.boldino-hotel.com/ckfinder/userfiles/files/pifirifasuwaziniwiwob.pdfIn PDF document text
- http://objets.immoweiss.lu/userfiles/files/ligolaguza.pdfIn PDF document text
- https://cashcruis.ru/wp-content/plugins/super-forms/uploads/php/files/738d904094702183a279e21bc69b7c43/gobazisusonuwovaripupine.pdfIn PDF document text
- http://m-s-g.ru/userfiles/files/subujumaxeruzoriwuji.pdfIn PDF document text
- https://gsm.company/ckfinder/userfiles/files/logawore.pdfIn PDF document text
- http://wirheiraten.de/images/file/zelifako.pdfIn PDF document text
- https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/tgsjknrhpqoqktckopfp30rbc6/lopubakoboruwukuv.pdfIn PDF document text
- http://ark-mr.com/data/home/qxu2063190031/htdocs/uploadfile/files/96455666084.pdfIn PDF document text
- http://proleague.dk/userfiles/file/rilanuwomixirenibagipopol.pdfIn PDF document text
- https://aordonez.com/images/contenidos/files/jopusebepepezir.pdfIn PDF document text
- http://baracenter.be/userfiles/file/59135413567.pdfIn PDF document text
- https://www.abrasco.org.br/ckfinder/userfiles/files/24451945138.pdfIn PDF document text
- https://xn--fct5g39pjpo.tw/upload/leakstop/files/jajonu.pdfIn PDF document text
- http://daglichtfilters.nl/ckfinder/userfiles/files/25823225014.pdfIn PDF document text
- http://srub-servis.ru/userfiles/file/37056304015.pdfIn PDF document text
- https://rlmahtani.com/userfiles/files/gaduwafunukuz.pdfIn PDF document text
- http://wolfroccatiassociati.it/userfiles/files/kuwojelezozuroganisixutif.pdfIn PDF document text
- http://linza-market.ru/upload/files/dolulejamotivelimanavus.pdfIn PDF document text
- https://undergroundtakeout.com/userfiles/file/zupixofutebim.pdfIn PDF document text
- https://tomorrowhubs.com/upload/users/files/68535105282.pdfIn PDF document text
- https://simondaulte.com/ckfinder/userfiles/files/kenexoxivilazix.pdfIn PDF document text
- http://fabriziocar.it/userfiles/files/xijepiw.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=galaxy+life+reborn+play+storePDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d4a4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD4A4	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000ecbb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xECBB	10744 bytes
SHA-256: `38837c8b5f32c36773d239b0fdef4c3e0ee609f68df84d9c60c55228459e3ce6`
`font_02_sfnt_off00010568.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10568	17604 bytes
SHA-256: `3304979dc4649200d9e98377141eddc77db4446c0298b84e742c554fe81a1f90`

Open this report in the interactive analyzer, or submit your own file for analysis.