Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec5dfd2b3cac60ed…

MALICIOUS

PDF

89.5 KB Created: 2021-09-17 05:19:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 5dba48fb5e7c5d15da53b657b2940164 SHA-1: 3b035a08b14326956ad084bbfaff6d6190c6848f SHA-256: ec5dfd2b3cac60ed03db2fee54d4ff31318cd39044576e14f352408036d5d955
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains numerous external URIs and is identified as a link farm on disposable hosting, suggesting it's used to redirect users to malicious sites. The presence of urgency lures further supports a phishing or social engineering attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/uplcv?utm_term=snapchat+text+box+android PDF link annotation
    • https://ev-owners.jp/userfiles/files/99370984211.pdfIn PDF document text
    • https://santa.sg/images/users/00000000/files/56965743641.pdfIn PDF document text
    • http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/7805874048f3958a3c97b87be513a33b/vitotuf.pdfIn PDF document text
    • http://chikatere.com/Upload/files/jamopojiruketowadijabix.pdfIn PDF document text
    • http://www.sictombbi.fr/ckfinder/userfiles/files/61958292283.pdfIn PDF document text
    • http://vector-mebel.ru/uploads/files/35052941477.pdfIn PDF document text
    • https://novahealthclinic.ca/userfiles/file/bekasonewolimasemed.pdfIn PDF document text
    • http://bsp-plovdiv.org/ckfinder/userfiles/files/34880337952.pdfIn PDF document text
    • https://athensviptour.com/wp-content/plugins/super-forms/uploads/php/files/542e54060d550b39c985a2a03cc389af/fesuwosuv.pdfIn PDF document text
    • http://fireprovietnam.net/luutru/files/netusefo.pdfIn PDF document text
    • http://mayjack.com/upload/files/migiwaxemis.pdfIn PDF document text
    • https://gregoryshow.ru/files/file/90218649398.pdfIn PDF document text
    • https://ngenadmin2.nextgenphotosolutions-beta.com/app/webroot/files/file/34462092300.pdfIn PDF document text
    • https://gikguamerica.com/userfiles/file/80483398047.pdfIn PDF document text
    • http://hstairan.com/fckeditor/editor/filemanager/connectors/php/userfiles/file/85556363066.pdfIn PDF document text
    • https://fotofidelity.cz/userfiles/file/lobepo.pdfIn PDF document text
    • https://freshchannels.com/home/sites/freshchannels/public_html/ckfinder/userfiles/files/15790204089.pdfIn PDF document text
    • http://belniig.by/public/file/wuvit.pdfIn PDF document text
    • http://yavuzselimvakfi.org/resimler/site/files/22760546465.pdfIn PDF document text
    • https://quimicasorocolor.com.ve/ckfinder/userfiles/files/26383906021.pdfIn PDF document text
    • http://creativetechno.in/userfiles/file/97484262208.pdfIn PDF document text
    • https://rjpexport.com/files/57798357627.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f566.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF566 10716 bytes
SHA-256: 63c6fc2700ff937282275c61302292cf4a95b7aeca01d81aa0b3ca1a7d39cbf9
font_01_sfnt_off00010dba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DBA 19696 bytes
SHA-256: 64a9b93542e10cac9af1cebe3c00e08f9cfdb6a580bcfbeefaab1afc72486062
font_02_sfnt_off00014073.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14073 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.