Malicious PDF — malware analysis report

Static analysis result for SHA-256 021ca07512519e14…

MALICIOUS

PDF

84.5 KB Created: 2021-07-22 11:17:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 1a1b713ae9d0b1e961d799fbce3bcfc8 SHA-1: 5e32172b0302049df79c7059786626f804da2616 SHA-256: 021ca07512519e14f1fbf1ce5061d51a514551289a6d8f281c25993818b69a69
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a PDF identified as malicious by ML classifiers and ClamAV, exhibiting characteristics of a link farm. It contains numerous URLs pointing to compromised WordPress sites, which in turn host further PDF files. This suggests a multi-stage attack, likely for phishing or malware distribution, where the initial PDF serves as a lure to lead users to malicious content hosted on other compromised infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://csom.cz/wp-content/plugins/super-forms/uploads/php/files/08e37e6cc9b8df1ff8d1c377c5b620a6/36055671705.pdf In PDF document text
    • http://osoboebludo.com/ckfinder/userfiles/files/semovezinavigajamekufonaj.pdfIn PDF document text
    • http://mirembeestate.co.ug/wp-content/plugins/formcraft/file-upload/server/content/files/160a610db68cb3---73517548330.pdfIn PDF document text
    • http://veronicanealhome.com/wp-content/plugins/formcraft/file-upload/server/content/files/2/1607511a837071---97234668023.pdfIn PDF document text
    • https://evocative.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16075658f6259e---9199326108.pdfIn PDF document text
    • https://webtechnocrats.com/upload/file/85962281483.pdfIn PDF document text
    • https://myphi.biz/nbloom/fckuploads/file/82812468476.pdfIn PDF document text
    • http://www.jhannahs.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b80aa2eb572---95678545002.pdfIn PDF document text
    • http://dakhoanhanai.com/images/files/15839813186.pdfIn PDF document text
    • http://www.deco-interieure.com/userfiles/file/lasovojawujerisatifu.pdfIn PDF document text
    • https://www.popcaffe.it/wp-content/plugins/super-forms/uploads/php/files/bdb9ef73e9f6af2c9cfdd99605477f87/62458204712.pdfIn PDF document text
    • https://www.tanyadantus.com/wp-content/plugins/super-forms/uploads/php/files/e24d2625e9f54c7cdeb0450ac47a8459/47152604731.pdfIn PDF document text
    • http://www.kmclogistics.com/wp-content/plugins/super-forms/uploads/php/files/bccdba205082d4680b26e9ae4604e939/64431321940.pdfIn PDF document text
    • https://pilotcenter.gr/wp-content/plugins/super-forms/uploads/php/files/n89b07hj1buamvv1atb4tin949/7396224276.pdfIn PDF document text
    • http://insidethedigitaltrend.biz/userfiles/file/88270038707.pdfIn PDF document text
    • https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/3d96c1403d401ae5143f3919a745a0e6/45116486603.pdfIn PDF document text
    • http://csc-0898.com/userfiles/file/20210630034613_hn399i.pdfIn PDF document text
    • https://roadtoring.com/wp-content/plugins/super-forms/uploads/php/files/44e3cf765bf46f078952ee286582c2ec/52380701855.pdfIn PDF document text
    • https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/bebhetp6p7t65g8tvt26o1dt01/72764676943.pdfIn PDF document text
    • http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c3aa0c1b9d8---nowizupemofafitedejam.pdfIn PDF document text
    • http://nena-artspace.com/ckfinder/userfiles/files/23184121547.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/A3Ryygt5BCM/uplcv?utm_term=what+is+the+principal+square+root+ofPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ce00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCE00 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000e617.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE617 10816 bytes
SHA-256: d59f2970650bcf3ad0e98af8add878ad2180981d81aebb9b4c4a8ebab6248ff9
font_02_sfnt_off0000fefe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEFE 17876 bytes
SHA-256: 7dd7824b3e9b7fea221da1d54d130de97d6c0686561df3256de787d84fc29f73
font_03_sfnt_off00012d76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D76 16468 bytes
SHA-256: ab2568333787251e8f45d06b858d73b5df894602814f117f6b0b2ccbf66e64e3

Open this report in the interactive analyzer, or submit your own file for analysis.