Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed70a5ecef2840e9…

MALICIOUS

PDF

63.7 KB Created: 2021-09-23 21:06:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: 23680e6b02bae3fa28b504810ffc4e2b SHA-1: 7b4866404463cfa5adcfa8ef7cba2a1f4dbbfffa SHA-256: ed70a5ecef2840e901a6468517c33511447b8f72c327337ed1c52bea10f2f379
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and a large number of external URIs, many of which are hosted on disposable domains. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a link farm strategy, and ClamAV detection confirms its malicious nature. The embedded JavaScript likely facilitates the redirection to these malicious sites, potentially for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5560

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=fear+the+walking+dead+episode+1+season+1 PDF link annotation
    • http://launensia.cz/ckfinder/userfiles/files/43932885200.pdfIn PDF document text
    • https://xn--fct8ml6mwue.tw/uploads/files/41716476501.pdfIn PDF document text
    • http://ayurveda-shiatsu-nice.com/upload/files/68476205155.pdfIn PDF document text
    • https://bahamianbrewery.com/ckfinder/userfiles/files/48691220441.pdfIn PDF document text
    • https://abofahed.com/userfiles/file/nixiradorebipixet.pdfIn PDF document text
    • https://zniczekowalczyk.com/user_images/file/pujekapugomofamapaw.pdfIn PDF document text
    • https://biocoop.legreniervert.fr/ckfinder/userfiles/files/29664629362.pdfIn PDF document text
    • https://feniks9.ru/ckfinder/userfiles/files/60524958749.pdfIn PDF document text
    • http://ipmarketing.net/FCKeditor/editor/filemanager/connectors/userfiles/file/35930568520.pdfIn PDF document text
    • https://kimansion.com/uploads/file/nusoronuluguzofipe.pdfIn PDF document text
    • https://threadworx.com/thread/admin/uploads/file/86113157023.pdfIn PDF document text
    • https://sklepbonus.eu/userfiles/file/14736144011.pdfIn PDF document text
    • http://laguna.piyawatgroup.com/images/files/xilatuvepujasa.pdfIn PDF document text
    • http://aeon-dev.com/uploads/files/202109131602573952.pdfIn PDF document text
    • http://domario.ru/userfiles/file/71753854285.pdfIn PDF document text
    • https://kozmetikadunakeszi.hu/userfiles/file/4131744743.pdfIn PDF document text
    • https://viveironativodevicosa.com.br/ckfinder/userfiles/files/bejajijakukavo.pdfIn PDF document text
    • https://geneticapanama.com/userfiles/file/kawub.pdfIn PDF document text
    • https://ladymamashop.com/uploads/files/202109082253222277.pdfIn PDF document text
    • https://chongtham68.com/app/webroot/uploads/files/2576043945.pdfIn PDF document text
    • https://panama4d.com/contents/files/59960292723.pdfIn PDF document text
    • https://phoneeucom.zabolekarburgas.com/userfiles/file/90555655133.pdfIn PDF document text
    • http://lawngo.net/fckfiles/59816845107.pdfIn PDF document text
    • http://burningspearmarketplace.com/js/ckfinder/userfiles/files/wajukulobasoxevisira.pdfIn PDF document text
    • http://odontotecnicacoop.it/userfiles/file/fanegevexigofulorakub.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.