Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8f90caa235fa75c…

MALICIOUS

PDF

58.9 KB Created: 2021-09-30 21:44:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: 6a2f23b4e6fb87b5002f0d1248a1ef07 SHA-1: 8dfb5c63317c4043631ef39a225d96a69bef4ddb SHA-256: f8f90caa235fa75c0758d01fa83ec18857434421b040677219fb1db69c08101b
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript, which is a common technique for executing malicious code within documents. The presence of numerous external URLs, many of which are associated with link farms and disposable hosting, suggests a phishing or credential harvesting attempt. ClamAV detection as 'Pdf.Phishing.Trojan' further supports the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7329

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=family+guy+scrooge+mcduck+gif PDF link annotation
    • https://zazilha.com.mx/wp-content/plugins/super-forms/uploads/php/files/74f55b7f9a4832c0a1c681950cf6ffc0/voduv.pdfIn PDF document text
    • http://henca.com/files/details/file/24290466545.pdfIn PDF document text
    • http://lyzebrno.cz/userfiles/file/80889348855.pdfIn PDF document text
    • http://salondebellezaanamariaromero.es/ckfinder/userfiles/files/zalivovaris.pdfIn PDF document text
    • https://belretail.by/ckfinder/userfiles/files/josatitilisagutojodu.pdfIn PDF document text
    • http://www.sudeshnamaulik.com/fckimages/file/janapudopojufi.pdfIn PDF document text
    • http://www.vikingmaterials.com/img/13850704719.pdfIn PDF document text
    • http://chandigarhdatarecovery.com/files/file/mapumegagexuniw.pdfIn PDF document text
    • http://hotel-gerard-dalsace.com/upload/document/77487622082.pdfIn PDF document text
    • http://karinameal.ru/imgdish/files/62797169884.pdfIn PDF document text
    • https://laundrybyconrads.com/nbloom/fckuploads/file/49107556460.pdfIn PDF document text
    • http://le-nora.com/userfiles/file/warolidilorigufojalow.pdfIn PDF document text
    • http://gutachterbewertung.de/userfiles/file/sosapixaluruvifijipimu.pdfIn PDF document text
    • http://basketaci.cz/UserFiles/File/11724948489.pdfIn PDF document text
    • https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/46aea6d90fa271f82a220b48ff47bbf3/80831468090.pdfIn PDF document text
    • https://essaidafm.com/uploads/FCK_files/file/juzoxowogunumoxe.pdfIn PDF document text
    • https://tivirtual.com/userfiles/file/19322799822.pdfIn PDF document text
    • https://reaga.net/js/ckfinder/userfiles/files/55194857464.pdfIn PDF document text
    • http://clubmaniacr.com/campannas/file/vedibafinupajekoleg.pdfIn PDF document text
    • https://gagiongvitgiong.com/ckfinder/userfiles/files/misikamedafiluw.pdfIn PDF document text
    • http://naturestuff.nl/siteimages/file/74043486675.pdfIn PDF document text
    • http://xn--q20b13r9leepaeb.net/upload/file/202109080450053539.pdfIn PDF document text
    • http://fu-xin.tw/uploads/files/202109011953363184.pdfIn PDF document text
    • http://jar-ted.pl/file/86715877511.pdfIn PDF document text
    • https://alident.centralcms.cloud/galeria/files/3864104017.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b22d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB22D 15436 bytes
SHA-256: 7b027e9c02a8c966ffb9d20fb9aa20a4548116ff310b4bbd616c61e5a03d6302

Open this report in the interactive analyzer, or submit your own file for analysis.