Malicious PDF — malware analysis report

Static analysis result for SHA-256 f271d04acd3c42a8…

MALICIOUS

PDF

62.3 KB Created: 2021-09-24 14:25:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 55bbc895e263d20e2dbab0baf7f64c77 SHA-1: 8fae0cd931c39be2e17c463edffa5d85b9eaa1c8 SHA-256: f271d04acd3c42a820465920e7a75b906bab588c0abdaa211eb0ff6fd465dabf
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and numerous external URIs, many pointing to disposable domains, indicating a link farm designed to obscure the ultimate destination. ClamAV detection and ML classification confirm its malicious nature, likely serving as a lure for phishing or malware delivery. The presence of embedded JavaScript suggests it may be used to exploit browser vulnerabilities or redirect the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5307

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xn--72ca1bzcdf9cg5df4n5a8cei.com/userfiles/files/xonotiveme.pdf In PDF document text
    • http://pc-driver.ru/userfiles/files/53720054257.pdfIn PDF document text
    • http://pogologistics.com/ckfinder/userfiles/files/vijipo.pdfIn PDF document text
    • http://spharma.ua/files/file/17744259869.pdfIn PDF document text
    • https://soudurelauziere.ca/upload/editor/file/98311939801.pdfIn PDF document text
    • http://gocchame.vn/app/webroot/img/uploads/files/39568179024.pdfIn PDF document text
    • http://djapm.com/userfiles/file/39550600390.pdfIn PDF document text
    • http://bertrandetgastineaudesigners.com/userfiles/file/25052637470.pdfIn PDF document text
    • http://musorcentrum.around.hu/files/article/file/vepujuz.pdfIn PDF document text
    • http://vstarmp.cn/upload/files/20210905_131620.pdfIn PDF document text
    • https://termoformat.md/img/files/mizig.pdfIn PDF document text
    • http://kkagro.com/media/images/upload/file/wokepobe.pdfIn PDF document text
    • https://glycocalyx.nl/userfiles/image/file/jewilesas.pdfIn PDF document text
    • http://www.stsmcc.org/www/js/ckfinder/userfiles/files/87235775016.pdfIn PDF document text
    • https://angkaganjil.com/contents/files/sutifakazegifixu.pdfIn PDF document text
    • http://paradisoseminatrici.it/userfiles/files/34898333912.pdfIn PDF document text
    • https://alstar.uz/images/shared/file/favunukimujosepepeg.pdfIn PDF document text
    • http://hanaelectric.com/userData/board/file/36900586350.pdfIn PDF document text
    • http://minhanh.com/files/pafosebinowotuv.pdfIn PDF document text
    • http://soskuwait.com/outscapes/admin/ckeditor/uploads/ck/files/45060167127.pdfIn PDF document text
    • https://bepxuyenviet.com/upload/files/71121667097.pdfIn PDF document text
    • https://easypayindia.in/userfiles/file/patimugokozedemiro.pdfIn PDF document text
    • https://comptables-publics.fr/userfiles/file/pixawolulojewonugog.pdfIn PDF document text
    • https://semsaesp.com/ckfinder/userfiles/files/domaga.pdfIn PDF document text
    • https://riwg.in/userfiles/file/varijepugavokonugu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=add+ringtone+androidPDF link annotation
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b2e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB2E8 10192 bytes
SHA-256: 16d9d10d2816409c9d54d28c1dbecfd6b2a11b0f48af661b852aa29bc2654532
font_01_sfnt_off0000c9a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC9A3 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.