Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf07eca79121c821…

MALICIOUS

PDF

64.0 KB Created: 2021-10-02 17:54:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-22
MD5: c8c37d8c1b178fc0075cd7901e7017b2 SHA-1: cde85b6c1882826e4f1a75752aba480c84ef40ac SHA-256: cf07eca79121c821a641dfffeb45c98199312f9ac743e84d581f2a8b35a72eec
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was identified as malicious by ClamAV with a 'Pdf.Phishing.Trojan' signature. It functions as a link farm, containing numerous external URLs pointing to potentially malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' further indicates a non-clustered link farm on disposable hosting, suggesting a phishing or malware distribution scheme. No scripts were extracted, but the presence of external URIs is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4625

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wastran.ru/uplcv?utm_term=geometry+connections+answer+key PDF link annotation
    • https://ozanetiket.com/TasarimAcarnet/serhali/upload/files/65829237353.pdfIn PDF document text
    • http://vdi.vn/userfiles/file/dizominesiwizarutomudi.pdfIn PDF document text
    • http://czminghe.com/upload/files/23660301229.pdfIn PDF document text
    • https://ocw.tw/uploads/files/69958872467.pdfIn PDF document text
    • http://lngpetro.com/userfiles/file/kinirififujiwadogebif.pdfIn PDF document text
    • http://sukhonthip.com/file_media/file_image/file/disogolej.pdfIn PDF document text
    • http://ainut.fi/userfiles/file/samaralokole.pdfIn PDF document text
    • https://europacreativaeuskadi.eu/files/galeria/files/lanukemodubisororowozak.pdfIn PDF document text
    • http://asr-net.ru/uploads/files/xereveserunovajosi.pdfIn PDF document text
    • http://remontnoedelo.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16155724b562ac---jamexida.pdfIn PDF document text
    • https://inc.pamlskovnik.cz/ckfinder/userfiles/files/bugimedulidujowo.pdfIn PDF document text
    • http://www.kizkulesikizogrenciyurdu.com/public/ckfinderuploads/files/40260792084.pdfIn PDF document text
    • http://myapartment.de/web/editor/files/64909773246.pdfIn PDF document text
    • http://taaltoetsvo.nl/userfiles/file/97124311020.pdfIn PDF document text
    • https://clubslotalmatriche.com/calcas/file/pazenalisab.pdfIn PDF document text
    • http://onishi-kyosendo.jp/archive/runizoxuritazeve.pdfIn PDF document text
    • http://tpdw.pl/userfiles/file/vawugivitomo.pdfIn PDF document text
    • http://tupnate.com/ckfinder/userfiles/files/foxonitadadurilawopepu.pdfIn PDF document text
    • http://vietsinphar.com/uploads/files/6252545812.pdfIn PDF document text
    • http://b-solutions.net/userfiles/file/bikupaxuxolusoreki.pdfIn PDF document text
    • http://alda.pl/ckfinder/userfiles/files/98894768361.pdfIn PDF document text
    • http://straps.by/ckfinder/userfiles/files/74675815392.pdfIn PDF document text
    • http://mobilenmr.com/files/files/62341496267.pdfIn PDF document text
    • http://dekoblickfang.de/userfiles/file/99913611429.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b088.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB088 10676 bytes
SHA-256: d4910afe01ce9757376755da991ba8c024eacc1d80850a1738c87c4fbc92d683
font_01_sfnt_off0000c926.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC926 15048 bytes
SHA-256: d7e99affde79e2901d5e14fa81d764304c8b5e8e386b02a63a203f8e2682fb58

Open this report in the interactive analyzer, or submit your own file for analysis.