Malicious PDF — malware analysis report

Static analysis result for SHA-256 f772e6b8c1240846…

MALICIOUS

PDF

80.6 KB Created: 2021-10-18 04:16:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23
MD5: bf67502ba951809fa5508128f875aba5 SHA-1: fb20ff0e0e53d1f0652f1615dfed525dcd8bacff SHA-256: f772e6b8c1240846e54a4b149200d0b947cd54192827ee0ba9486a32df3cd886
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of numerous external URIs, including one on disposable hosting, suggests a link farm or phishing lure. The 'SE_URGENCY_LURE' heuristic further supports the phishing pretext, indicating the document likely contains language designed to prompt immediate action.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/uplcv?utm_term=medieval+quiz+questions+and+answers PDF link annotation
    • http://digitalpolicycouncil.com/imagenes/file/17411868648.pdfIn PDF document text
    • http://take114.kr/FileData/ckfinder/files/20210905_A3A0E21423CDC1D0.pdfIn PDF document text
    • https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613636dc368d3---61260452333.pdfIn PDF document text
    • http://space-edge.com/upload/files/28737930411.pdfIn PDF document text
    • http://mcutech.net/files/85436574288.pdfIn PDF document text
    • http://usaoxin.com/userfiles/2021-9/file/kodilum.pdfIn PDF document text
    • https://archielectronics.com/userfiles/files/5731152661.pdfIn PDF document text
    • http://japhina.com/upload/file/43015625501.pdfIn PDF document text
    • http://dyneco.kr/userData/board/file/sizumadevifa.pdfIn PDF document text
    • http://vaynhe.com/upload/files/72094305399.pdfIn PDF document text
    • http://aktifithalat.com/resimlerfiles/gakepozigivutodazitevuwez.pdfIn PDF document text
    • http://markalikonut.com/UserFiles/file/babufifojororebavetitaxos.pdfIn PDF document text
    • http://horizonpestservices.com/userfile/butif.pdfIn PDF document text
    • https://savitravel.ro/ckfinder/userfiles/files/27359857943.pdfIn PDF document text
    • https://jackinthegym.com/uploads/files/202110051424432996.pdfIn PDF document text
    • https://siltri.com/fck_upload/file/36945160279.pdfIn PDF document text
    • https://rodolphe-blanchet.fr/Rodolphe/fckeditor/file/74266097160.pdfIn PDF document text
    • http://mentaplywood.com/images_upload/files/44957795878.pdfIn PDF document text
    • http://mentaplywood.com/images_upload/files/fapazajijanomal.pdfIn PDF document text
    • http://potya.com/17316595403.pdfIn PDF document text
    • http://donauwell.at/userfiles/file/bokagazarizexemi.pdfIn PDF document text
    • http://okna-stv.ru/userfiles/files/45906007385.pdfIn PDF document text
    • https://fotobolfestmeny.hu/mvc/userfiles/file/79704894169.pdfIn PDF document text
    • http://farmaciafasolis.eu/userfiles/files/nolavu.pdfIn PDF document text
    • http://batdongsandautieng.com/upload/ck/files/80954055580.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d763.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD763 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000ef75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF75 17176 bytes
SHA-256: 9cd219a157cdf53a73753011b408428f5b2d81d372123d89cc4f1310bf5cbda6
font_02_sfnt_off00011bfc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11BFC 10692 bytes
SHA-256: 9c8e6b04fe5234a7e7232050041416978b14a12d3887f74a0c80b9d001cf7555

Open this report in the interactive analyzer, or submit your own file for analysis.