Malicious PDF — malware analysis report

Static analysis result for SHA-256 e42d42a44dfe6528…

MALICIOUS

PDF

59.8 KB Created: 2021-04-04 00:42:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 6f5003cc3380bdfce727cd03bc97d0df SHA-1: 7b453916dd1eb67b0e88307de647535f908b56d3 SHA-256: e42d42a44dfe6528f80faf188a0aaab774f1a0f7e109a3f0bc68c7c930064ed8
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, many of which point to unknown or potentially malicious domains, suggesting a link farm or phishing lure. The ClamAV detection and ML classifier flagging indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a phishing or malware distribution attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8968

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fezideruxojogo.iblogger.org/accelerated_rehabilitation_after_anterior_cruciate_ligament_reconstruction.pdf In PDF document text
    • http://kreativoblako.com/pajuzi0vy8t.pdfIn PDF document text
    • https://pedexanagokol.weebly.com/uploads/1/3/4/6/134635549/jelexirenepis.pdfIn PDF document text
    • http://lifegirls.site/putumig8mzu.pdfIn PDF document text
    • https://kizifafub.weebly.com/uploads/1/3/4/7/134714450/8955415.pdfIn PDF document text
    • https://pozimifekof.weebly.com/uploads/1/3/4/6/134674510/6717927.pdfIn PDF document text
    • https://liniraniz.weebly.com/uploads/1/3/5/3/135339257/fezazugalinupisezon.pdfIn PDF document text
    • http://ighelpcenter.xyz/14034232255y1639.pdfIn PDF document text
    • https://lokeduvedip.weebly.com/uploads/1/3/4/8/134885922/9867442.pdfIn PDF document text
    • http://instgrmmverifiedbadge.com/maze_runner_3_film_streaming_itas1ntc.pdfIn PDF document text
    • http://odebayitrafikhizmeti.com/pesarelebaxzgtw.pdfIn PDF document text
    • http://fewotiza.iblogger.org/jurnal_agama_hindu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://feedproxy.google.com/~r/wb/ENAH/~3/_7yJ53orglQ/wb?keyword=himno%20al%20maestro%20peruano%20letra%20y%20musicaPDF link annotation
    • https://uploads.strikinglycdn.com/files/3293775c-8263-4048-9f42-04b9cff85aef/theories_of_intercultural_communication_ppt.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b6d9bd5-e2c8-4e4a-9dfa-e707c95372f4/63782039299.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f9cc979-a7b3-4701-aa6e-65ee2332bd64/how_to_create_a_vrchat_avatar_from_scratch.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca52f2a8-d376-41a5-928e-2ec28fce9e8c/amc_8_2015_honor_roll.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f5c2954-e9ef-41c1-863c-0945439e8cc3/air-o-swiss_aos_7531_replacement_demineralization_cartridge_for_ultrasonic.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23c9c6fd-a4ac-407d-ae14-b1f0c2a3f660/98382117104.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1bc4c9b8-5223-4d1f-9b11-c93560ae2476/mefix.pdfIn PDF document text
    • http://famuruvif.epizy.com/tozedibokogenopoveragul.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC2E 5024 bytes
SHA-256: 06a426fe2d75c756cbc2a425376ff9db0eb125b2420f061421f8bee0d3fecb07

Open this report in the interactive analyzer, or submit your own file for analysis.