PDF malware analysis — malicious · e4cb341f82a61406

MALICIOUS

PDF

65.1 KB Created: 2021-10-01 20:08:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25

MD5: a7e401ee91c935981c69cebfeb6eef4c SHA-1: 19a35da1658f526975ff3c7391992a84e4f41678 SHA-256: e4cb341f82a61406de19acef12a9e82f76013156341bd5a41a91c1db1e7d9088

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as a phishing trojan by ClamAV. Static analysis revealed numerous embedded URLs, with one heuristic identifying it as a link farm on disposable hosting. The primary URL points to a site that appears to be a lure for pirated content, suggesting a phishing or malware distribution vector. No scripts were extracted, but the PDF structure and URL patterns are indicative of malicious intent.

Machine Learning

Nyx PDF Classifier suspicious score 0.3962

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://garglob.ru/uplcv?utm_term=law+and+order+svu+season+22+putlocker PDF link annotation
- http://akgwealthplanner.com/crm/files/nefazurapotosudowera.pdfIn PDF document text
- https://alummaswaja.com/yii/sdbalikpapan/home/images/upload/files/nesufulaxewarazobemetev.pdfIn PDF document text
- http://botosani.ro/img/uploads/file/14997081277.pdfIn PDF document text
- https://glbtrader.com/userfiles/file/9632740894.pdfIn PDF document text
- https://www.wikiwebagency.it/wp-content/plugins/super-forms/uploads/php/files/9b9675dfbc01801ed095aa231bd3b8a3/99873649681.pdfIn PDF document text
- http://hotelrealerimini.it/userfiles/files/lunigojukitopeno.pdfIn PDF document text
- http://saydersan.com/firma/files/mesavoxejopepobive.pdfIn PDF document text
- https://bfull.ru/uploads/files/gorojabodepo.pdfIn PDF document text
- https://copyjokertw.aw6.tw/uploadfile/qu4_qu106_com/files/99800023193.pdfIn PDF document text
- http://vindindex.nl/images/uploads/14260341280.pdfIn PDF document text
- https://cli-kh.com/uploads/files/202109080646389749.pdfIn PDF document text
- http://cmtsport.com/pliki/93600858914.pdfIn PDF document text
- http://greatwalledmond.com/ckfinder/userfiles/files/daniwotofagiz.pdfIn PDF document text
- http://iviltra.lt/images/files/67213045148.pdfIn PDF document text
- http://sangjeom.com/userfiles/file///buvogul.pdfIn PDF document text
- http://clickvay.com/upload/files/23922948450.pdfIn PDF document text
- http://rszm88.com/upfolder/e/files/20210916210201.pdfIn PDF document text
- http://auburn-companies.com/userfiles/files/72699674154.pdfIn PDF document text
- https://ap-qatar.com/userfiles/files/werexe.pdfIn PDF document text
- https://2winit.com/Files/files/bedapifolurawesafegesas.pdfIn PDF document text
- http://nanoscopy.ru/uploads/files/jijegusubizafes.pdfIn PDF document text
- https://mcq-exambd.com/app/webroot/ckfinder/userfiles/files/51796355330.pdfIn PDF document text
- https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/5828a099cbee86a10050418f36915a8e/buduluxepimubojemakasukax.pdfIn PDF document text
- https://101doctor.com/uploads/ckfiles/files/613ed82134d38.pdfIn PDF document text
- https://liho.cz/UserFiles/File/ponekikeziruvejubikerowoz.pdfIn PDF document text
- http://s292376414.onlinehome.fr/datas/imgmail/file/86593047165.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b22c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB22C	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000ca3e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCA3E	17496 bytes
SHA-256: `40aecac2ccb1ca2ae1e29d077db0786b4338fa3ceeddb822471459f4113cf180`

Open this report in the interactive analyzer, or submit your own file for analysis.