Malicious PDF — malware analysis report

Static analysis result for SHA-256 01e072d56a8a0f73…

MALICIOUS

PDF

94.9 KB Created: 2021-06-26 12:47:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: ef5ba4011ee7b0356dea2ea07ec86f0a SHA-1: c673656935eb4dbf00031b138dcd4fc8f394670b SHA-256: 01e072d56a8a0f73db3e789a571445a20e449d5275cebb5e408bf9171cc7a8ce
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as Pdf.Phishing.Trojan. The file functions as a link farm, containing numerous embedded URLs that point to compromised WordPress sites and other disposable hosting domains. These links likely lead to phishing pages or further malware downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/uplcv?utm_term=baptism+for+the+dead+scripture PDF link annotation
    • https://motelandratecuci.ro/userfiles/file/fuxujunokujijovogat.pdfIn PDF document text
    • http://accessiblevehicleservices.com/userfiles/file/45280857495.pdfIn PDF document text
    • https://mygamedaysports.com/wp-content/plugins/super-forms/uploads/php/files/489d4c38645258c49a4dd24adfcb3b45/dovikawisose.pdfIn PDF document text
    • http://altinay-law.com/images/file/16818351747.pdfIn PDF document text
    • http://wakingbeauty.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089450368f96---22865032284.pdfIn PDF document text
    • https://chocoinmobiliario.com/wp-content/plugins/super-forms/uploads/php/files/5ea748ae05e6a908fc671131011997ee/41264617841.pdfIn PDF document text
    • https://shayangroup.net/wp-content/plugins/super-forms/uploads/php/files/e7297681631bdbbc672d742f4bd42c83/danasanizozet.pdfIn PDF document text
    • http://dailitara.lt/bites/uploads/file/mowinewabiv.pdfIn PDF document text
    • http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608036b57f31e---90102270262.pdfIn PDF document text
    • https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160716ee55378f---sebelokexevikufepesimif.pdfIn PDF document text
    • http://ttlengenharia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606f696b36f3f---vevoloda.pdfIn PDF document text
    • http://dbcasagayathottam.org/assets/uploads/cms_images/files/xosapuxibexopenip.pdfIn PDF document text
    • https://oddluzanie.net/userfiles/file/wusazadiregiboligozefibe.pdfIn PDF document text
    • http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609bc18d2d20e---vilukalekoxiwomanetozubis.pdfIn PDF document text
    • http://alexlunacoach.com/img/editor/file/96791935651.pdfIn PDF document text
    • http://lawcab.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607a17ecdca56---40108621874.pdfIn PDF document text
    • https://directprocessors.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8e27b5dde---teroserarirupofar.pdfIn PDF document text
    • https://www.olympusnorge.no/wp-content/plugins/super-forms/uploads/php/files/ek8u8tlsasdufqko18dd6i3u6i/zibijulozoladuranumopetu.pdfIn PDF document text
    • http://www.phonefixcomo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b7ae3c85ad---92139791382.pdfIn PDF document text
    • https://www.etbsupplies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5be942566e---25730214982.pdfIn PDF document text
    • https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/4q4bdg6c626d5r7g1pdt28dfh4/wisavefisomepisarodux.pdfIn PDF document text
    • http://anonelectronics.com/admin/fckeditor/editor/filemanager/connectors/php/upload_jpg/file/202105220703498648.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000109b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109B2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off000121c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121C9 10888 bytes
SHA-256: e1d3d47358bc0426a813768a5b61d94cb87944f7c838f4914f1f418afad53ca6
font_02_sfnt_off00013b0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B0A 19816 bytes
SHA-256: 8fc931e92993e22f390084b588375ebb59dd23872341ab420b85b53fbd3e281c

Open this report in the interactive analyzer, or submit your own file for analysis.