Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec7e1ad2ce19315b…

MALICIOUS

PDF

73.3 KB Created: 2021-09-22 23:03:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 651d90873fade1facf29ba0dce952a75 SHA-1: ead65e77bc648b8112ce36623c55503317d9aa89 SHA-256: ec7e1ad2ce19315b7e50774d5951ce11b6cb4a4ada9206fa799658ae87d5c5d3
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous embedded links, many of which point to disposable hosting and are likely part of a link farm designed to redirect users to malicious content. The ClamAV detection and the 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristic strongly indicate a phishing or malware distribution attempt. While no scripts were explicitly extracted, the nature of the embedded links suggests an attempt to lead users to a compromised site, potentially for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier clean score 0.0453

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tycoonmedical.com/userfiles/file/88497714805.pdf In PDF document text
    • https://www.la-melodie-des-saveurs.fr/ckfinder/userfiles/files/67559114578.pdfIn PDF document text
    • https://webdatedepot.com/userfiles/file/32673492442.pdfIn PDF document text
    • http://syarmarka.ru/userfiles/files/mareb.pdfIn PDF document text
    • http://mikailang.net/userfiles/file/20210905111718_1194227632.pdfIn PDF document text
    • http://xaydunglenguyen.vn/upload/files/e0780a.pdfIn PDF document text
    • https://milorem-service.ru/userfiles/file/89659584480.pdfIn PDF document text
    • http://unesco-mediain.cz/fckfiles/file/savosusoditu.pdfIn PDF document text
    • http://nage-z.com/ckfinder/userfiles/files/69871544104.pdfIn PDF document text
    • http://bioaec.com/userfiles/files/dulinozubojezamofepadetub.pdfIn PDF document text
    • http://solarissoft.com/img/userfiles/files/7206400525.pdfIn PDF document text
    • https://educhina.mn/editor/files/zugidajuwelutusuwafubewe.pdfIn PDF document text
    • http://beiwendq.com/data/attachment/file/juvugavifaxibuver.pdfIn PDF document text
    • https://megashina24.ru/files/files/jukofi.pdfIn PDF document text
    • http://nd-58.ru/wp-content/plugins/super-forms/uploads/php/files/557378a0ac76387b600f84ee5a0f53aa/joviwexipuxifelodizawazov.pdfIn PDF document text
    • http://yeosingol.com/FileData/ckfinder/files/20210908_5FCF70A807B344FF.pdfIn PDF document text
    • http://immobilieninvestors.com/userfiles/file/26195842168.pdfIn PDF document text
    • http://box8websites.com/ckfinder/userfiles/files/81555312964.pdfIn PDF document text
    • http://lab4050.com/upload/editor/file/mifimalupakozakilopaja.pdfIn PDF document text
    • http://vtvxm.vn/userfiles/file/mudajebujabasamevunomapux.pdfIn PDF document text
    • https://mymovingestimate.com/wp-content/plugins/super-forms/uploads/php/files/9163c73b0824d08e3d7504fa61fa4dfb/28429886493.pdfIn PDF document text
    • http://bc-arman.kz/ckfinder/userfiles/files/zobasidevigegaxite.pdfIn PDF document text
    • http://nuovojob.com/userfiles/files/zimex.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/A3Ryygt5BCM/uplcv?utm_term=the+conjuring+3+full+movie+in+telugu+movierulzPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bff8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBFF8 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000d80f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD80F 10944 bytes
SHA-256: 437037df831b1baa7b1a5729a0215a259b492bc74542e02958a879d05ce58375
font_02_sfnt_off0000f146.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF146 18160 bytes
SHA-256: f3b3529c3775cef35f9ad68811d044de894e830495c78768086bc5fcd58dadc3

Open this report in the interactive analyzer, or submit your own file for analysis.