Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9ed435e29aef31a…

MALICIOUS

PDF

84.5 KB Created: 2021-09-23 17:09:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 010b69d03cb1a65f729a92ccdebe70c4 SHA-1: ffa2674548002656188ebd28d9d8a1018638ad93 SHA-256: f9ed435e29aef31ae38f7a2ebe79540e296cf67e06bd431a3a60e6650c13c082
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF file identified by ClamAV as a phishing trojan. It contains a large number of embedded URLs, many of which point to disposable hosting and are part of a link farm, suggesting a phishing or malware distribution campaign. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports this, indicating a non-clustered link farm on disposable hosting.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3897

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/uplcv?utm_term=how+to+port+pc+game+to+android PDF link annotation
    • http://liluby.com/upload/file/56300790353.pdfIn PDF document text
    • http://quangcaosmsgiare.com/media/ftp/file/16381920344.pdfIn PDF document text
    • http://poketomecam.com/uploads/files/93418897140.pdfIn PDF document text
    • http://www.ambatownship.com/ckfinder/userfiles/files/bujekuvawakolixe.pdfIn PDF document text
    • http://dayuntang.com/assets/uploads/ckedit/files/20210918003440.pdfIn PDF document text
    • http://hyosangjo.com/userfiles/file/20210916215252.pdfIn PDF document text
    • http://hanlacsclub.com/ckupload/files/winapu.pdfIn PDF document text
    • http://lindendirect.com/ckfinder/userfiles/files/wamubadexodixewix.pdfIn PDF document text
    • https://landbondcorten.com/attachment/file/aaa7fa030c5761f53908236bc798c810.pdfIn PDF document text
    • http://shinhwacar.com/userData/board/file/48216639778.pdfIn PDF document text
    • http://yummyschool.com/_UploadFile/Images/file/zudukilexaxusirivomisasij.pdfIn PDF document text
    • https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/ab45d5807804a2da36e3b9c775d97be0/nuwuzazufe.pdfIn PDF document text
    • http://spbmedaks.ru/sites/default/files/uploads/doresofututeforo.pdfIn PDF document text
    • https://miet.hu/kepek/nufakopagutu.pdfIn PDF document text
    • http://soles2walk.cz/data/file/vupoxileza.pdfIn PDF document text
    • http://pop-around.com/file_media/file_image/file/gulutilisadupekowibumor.pdfIn PDF document text
    • http://gesundezellen.de/neu/userfiles/file/73509661521.pdfIn PDF document text
    • https://nordavril.com/userfiles/file/14614886768.pdfIn PDF document text
    • https://sausalito.com/wysiwygfiles/file/97276392300.pdfIn PDF document text
    • http://abarappresentanze.it/userfiles/files/tupax.pdfIn PDF document text
    • http://thegioixedap.net/upload/files/kulebafitonawelapet.pdfIn PDF document text
    • http://chongros.com/userData/board/file/7021656276.pdfIn PDF document text
    • http://erdbau-rauch.at/49255148580.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f60c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF60C 18188 bytes
SHA-256: 10eda50d31e59275ca331d4cde00fa4867631adb3f660fd5611fa72f7fa3723c
font_01_sfnt_off000124b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124B0 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013cc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13CC7 10720 bytes
SHA-256: f011ff5b3d118b90fe2ddc57c0db995738630a2b7d5749535467c0d0f8403536

Open this report in the interactive analyzer, or submit your own file for analysis.