Malicious PDF — malware analysis report

Static analysis result for SHA-256 d05684c523d38a6b…

MALICIOUS

PDF

67.5 KB Created: 2021-09-12 12:45:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: f38b2e68c0641278b472ed0c2d8b7d47 SHA-1: 09f1b1ac21dc1a6d1a7da2c860960b567d27f851 SHA-256: d05684c523d38a6b77a600736d7e4cd39e74fcec85bb526c8ca535df10fc7c57
102 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, a common technique for executing malicious code within documents. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' and the numerous extracted URLs suggest a link farm designed to obscure the ultimate destination, likely a phishing or malware distribution site. The ClamAV detection further confirms its malicious nature.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4667

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://home-consult.lu/userfiles/files/dabezaroxab.pdf In PDF document text
    • https://gmnavarra.es/ckeditor/files/32994058079.pdfIn PDF document text
    • http://nacyc.jp/Upload/file/wikevasag.pdfIn PDF document text
    • http://saipanbooking.com/FileData/ckfinder/files/20210902_12927DC9055A4894.pdfIn PDF document text
    • http://dienvietbac.com/uploads/files/ragawipudepejemubalag.pdfIn PDF document text
    • http://alda.pl/ckfinder/userfiles/files/xaporivelukabewo.pdfIn PDF document text
    • https://newdesert.pl/userfiles/file/9313747020.pdfIn PDF document text
    • http://on-video.com/movies/movie_data/file/rofuxiravezupijofudewa.pdfIn PDF document text
    • https://doublehair.center/upload/ckfinder/files/40128205325.pdfIn PDF document text
    • https://vietnaminsight.biz/ckfinder/userfiles/files/65372862476.pdfIn PDF document text
    • http://vietsinphar.com/uploads/files/15390003503.pdfIn PDF document text
    • http://xn--2e0b30g3uq7pay7m.com/upload/fckeditor/file/zazukuxumaxeti.pdfIn PDF document text
    • http://maezawa-jidousha.com/js/upload/files/taziwijovulubuti.pdfIn PDF document text
    • https://turismopontevedra.com/ckfinder/userfiles/files/gejozulapiga.pdfIn PDF document text
    • https://www.diktu.com/wp-content/plugins/formcraft/file-upload/server/content/files/16133bca2b9b04---lapip.pdfIn PDF document text
    • http://efeotokiralama.com/Upload/file/15592110272.pdfIn PDF document text
    • https://certifiedcollisionrepair.com/home/cert/public_html/ckfinder/userfiles/files/70800340082.pdfIn PDF document text
    • http://cosmikkino.ru/sadm_files/57530525857.pdfIn PDF document text
    • http://shoreluxurylimos.com/userfiles/files/waxolosojojitukid.pdfIn PDF document text
    • https://rajnnuhiddje.se/userfiles/file/pekidakiwifusipuxo.pdfIn PDF document text
    • http://agriturismolataggiasca.eu/userfiles/files/zumosivovumobenexosumo.pdfIn PDF document text
    • http://xn--rssx31a7tec6p.com/upload/userfiles/files/20210912102827.pdfIn PDF document text
    • https://www.elshandmadedesign.nl/ckfinder/userfiles/files/7948371349.pdfIn PDF document text
    • http://tiszaikaland.hu/upload/file/83365266502.pdfIn PDF document text
    • https://highrise.pl/file/2419895258.pdfIn PDF document text
    • http://tipkeo.com/js/ckfinder/userfiles/files/14829364087.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=copyright+act+notes+pdfPDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.