Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff109de1effe928d…

MALICIOUS

PDF

75.5 KB Created: 2021-10-10 10:09:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24
MD5: 89f4f614ff460100ed82619a70238e5f SHA-1: c43b1e1982463643d0e1becca99f2f57c05ce5e8 SHA-256: ff109de1effe928d4c8d1a55a8d480d43864d5c19be36dbaaeb28f932b87ce17
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, a common technique for delivering malicious content or redirecting users to malicious websites. The heuristic firings and numerous external URLs, many hosted on disposable domains, strongly indicate a phishing or malware distribution campaign. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7925

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/uplcv?utm_term=dna+structure+and+function+worksheet+ap+biology PDF link annotation
    • http://mlsconsulting.net/cms/files/File/79962347108.pdfIn PDF document text
    • https://faresaldabbous.com/uploads/file/24211663585.pdfIn PDF document text
    • http://ferramentabelleggia.it/public/file/98317912188.pdfIn PDF document text
    • http://eko-uklid.com/files/file/ninanivomop.pdfIn PDF document text
    • http://pavcargo.ru/wp-content/plugins/super-forms/uploads/php/files/33864e11ef52446eae40686995233eb9/kawerimixexe.pdfIn PDF document text
    • https://illustrations.noche.fr/images/files/61192490658.pdfIn PDF document text
    • http://xn--or3bo5mvlb.com/data/editor/file/3259869710.pdfIn PDF document text
    • http://gocchame.vn/app/webroot/img/uploads/files/wubavisovebowuxinamarowa.pdfIn PDF document text
    • http://www.firengo.com/userfiles/files/gopuf.pdfIn PDF document text
    • https://receptabc.hu/images_banner/files/viginozepimivotogusexu.pdfIn PDF document text
    • http://www.gpkoaee.ru/ckfinder/userfiles/files/patoroluwepaf.pdfIn PDF document text
    • https://maxlinder.com/admin/assets/ckfinder/userfiles/files/lutovonexobibizero.pdfIn PDF document text
    • https://0922.sproname.com/files/userfiles/files/xopulawolem.pdfIn PDF document text
    • https://www.ayersworthglen.com/wp-content/plugins/formcraft/file-upload/server/content/files/16136878229fd8---24081152366.pdfIn PDF document text
    • http://tomasmrazek.cz/userfiles/file/80230453077.pdfIn PDF document text
    • https://hebatkeren88.com/contents/files/80432954748.pdfIn PDF document text
    • https://marlin-aquarium.ru/ckfinder/userfiles/files/famokix.pdfIn PDF document text
    • https://imad0c0.com/js/ckfinder/userfiles/files/48704985704.pdfIn PDF document text
    • https://cafesca.mx/ckfinder/userfiles/files/53717365979.pdfIn PDF document text
    • http://tajilin.com/upload/files/41365102939.pdfIn PDF document text
    • http://vln.nl/files/file/73620408216.pdfIn PDF document text
    • http://vivo-mebel.ru/upload/file/40578577118.pdfIn PDF document text
    • http://nicenpos.com/userData/board/file/89983050740.pdfIn PDF document text
    • http://phuketdriveschool.com/userfiles/file/ruminufuluzutosaj.pdfIn PDF document text
    • http://iwayman.com/uploadfiles/file/210914021724742781tuja1k.pdfIn PDF document text
    • https://betenagro.com/sites/default/files/file/rebefugodolikupuwaf.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD0D 11432 bytes
SHA-256: 3788c234cbbb1d24c3d48a4f59fd3b7a5ee4183ade584f71c7b8535344f46766
font_01_sfnt_off000117ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117AB 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1