Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5832fd4e2cd24c5…

MALICIOUS

PDF

52.9 KB Created: 2021-09-08 23:49:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 612b32bc49af722ddcec9e379285a5e5 SHA-1: e243fd816f65d1f2b7cb529f9811c85016468fdf SHA-256: e5832fd4e2cd24c5eaa38e871195c86af652201511693535e3da7f3d24343c40
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected by ClamAV as Pdf.Phishing.Trojan. Static analysis revealed it contains a large number of external URIs pointing to disposable domains, a common tactic for phishing or malware distribution. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports this, indicating a link farm on disposable hosting. No scripts were extracted, but the overall structure suggests a phishing lure.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4952

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fuze-pay.com/ckfinder/userfiles/files/fubezewetepiwiti.pdf In PDF document text
    • http://gmkms.net/upfile_editor/2021/files/24357769230.pdfIn PDF document text
    • http://smwiarus.pl/ckfinder/userfiles/files/sokekatalumosowu.pdfIn PDF document text
    • http://partnercable.hu/files/zububix.pdfIn PDF document text
    • http://ddservice-bmw.pl/userfiles/file/44027513687.pdfIn PDF document text
    • http://wsystem.sk/userfiles/files/minotakenemalis.pdfIn PDF document text
    • http://thucphamchucnangmy.vn/uploads/files/2191472662.pdfIn PDF document text
    • http://homeopathyhk.com/files/leboravojuk.pdfIn PDF document text
    • http://wawabed.pl/uploads/userfiles/file/zufowadajowijo.pdfIn PDF document text
    • http://serting.eu/userfiles/files/bonim.pdfIn PDF document text
    • http://businessdevelopmentcenter.pl/uploads/userfiles/files/94826905156.pdfIn PDF document text
    • http://batdongsandothanh.vn/luutru/files/22597733459.pdfIn PDF document text
    • http://topenglish.sk/app/webroot/gallery/files/24979766032.pdfIn PDF document text
    • http://sinocelltech.com/filespath/files/20210902122310.pdfIn PDF document text
    • http://gazomotor.com/allinone/file/tukuxewovupo.pdfIn PDF document text
    • https://tidurmalam.com/contents/files/20538536648.pdfIn PDF document text
    • http://cellesekorea.com/ckupload/files/67512339629.pdfIn PDF document text
    • https://weblative.com/wp-content/plugins/super-forms/uploads/php/files/vppsq7p96dl2noiv4f3iniu1tc/zitajex.pdfIn PDF document text
    • https://truongthanhco.vn/webroot/img/files/32127483182.pdfIn PDF document text
    • http://stattus.com/assets/file/xatamubibimiwedexoj.pdfIn PDF document text
    • http://lechioutdoor.com/userfiles/file/41747843954.pdfIn PDF document text
    • http://zoekidsworld.com/userfiles/file/47066286849.pdfIn PDF document text
    • http://petrduchek.com/files/vugugonetijari.pdfIn PDF document text
    • http://auburn-properties.com/userfiles/files/notabevizuresu.pdfIn PDF document text
    • http://uts.edu.co/portal/app/ckfinder/userfiles/files/25922325433.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/PmAiG5ZyT-k/uplcv?utm_term=the+power+of+now+in+marathi+pdf+free+downloadPDF link annotation