Malicious PDF — malware analysis report

Static analysis result for SHA-256 02bbdc6932bdd7c8…

MALICIOUS

PDF

99.7 KB Created: 2021-07-10 12:13:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: f5e812b18659a33f0afc63996c8e1aeb SHA-1: 1bb0b34b8c64d76ed1919558eeb50931d954c941 SHA-256: 02bbdc6932bdd7c818f2d2ed94b732d82634770f42bcd7af50589f2762d75197
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristics reveal it functions as a link farm, with numerous URLs pointing to compromised WordPress sites, suggesting a phishing or malware distribution scheme. The document body is heavily obfuscated and unreadable, providing no direct clues about its purpose beyond the heuristic findings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9784

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=retroactive+date+meaning+in+insurance PDF link annotation
    • https://trucraftsmanship.com/wp-content/plugins/formcraft/file-upload/server/content/files/16074a3c5c1506---26919021753.pdfIn PDF document text
    • https://wentworthre.com/wp-content/plugins/super-forms/uploads/php/files/125fc7555a7540a9f6ee1a675cc585df/gosiragesuzokafi.pdfIn PDF document text
    • http://vtracauto.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094396b48e13---zateniloxoranoko.pdfIn PDF document text
    • https://www.andyselfstorage.co.uk/wp-content/plugins/super-forms/uploads/php/files/045edb7f2miv9auf40spkvvdo0/11908842969.pdfIn PDF document text
    • http://lawcab.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16087c6edda9ab---pomalidanurupud.pdfIn PDF document text
    • https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/7c4dalbs3p56ugg8coi5nfc1kr/kerewirewa.pdfIn PDF document text
    • https://bangprice.combangprice.com/beta/cms_image/file/fixesikere.pdfIn PDF document text
    • http://www.saraviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1a58fcc8dc---dovepopokixazanafuri.pdfIn PDF document text
    • http://zpb-maciejewski.pl/upload/fck/file/80922796465.pdfIn PDF document text
    • http://www.caribbeandentist.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be55cf4691a---36261943765.pdfIn PDF document text
    • https://mepho.hu/ckfinder/userfiles/files/58183954689.pdfIn PDF document text
    • http://nordicaluminium.ru/userfiles/file/309442886.pdfIn PDF document text
    • https://www.scanworld.se/wp-content/plugins/formcraft/file-upload/server/content/files/16079f7e03d455---xejagexuga.pdfIn PDF document text
    • http://bahattinburyan.com/userfiles/file/zidufurorikebopatadake.pdfIn PDF document text
    • http://akcjonariusz.com/UserFiles/file/11923672801.pdfIn PDF document text
    • http://protech.com.ng/wp-content/plugins/formcraft/file-upload/server/content/files/160ba99209f1b1---bamoko.pdfIn PDF document text
    • https://serka.com/serka/upload/files/27476637139.pdfIn PDF document text
    • http://www.virtualaid.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16075e34af1975---32635691047.pdfIn PDF document text
    • https://sgdivorcelawyers.com/wp-content/plugins/super-forms/uploads/php/files/c3c0f5b53b021d39c685a0f655400f32/66466806155.pdfIn PDF document text
    • http://www.insurancedirectcanada.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160a3d276294d7---regegifumajima.pdfIn PDF document text
    • http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/1608c8577408b6---bijubezedufuladizulezesop.pdfIn PDF document text
    • https://www.reliancecareuk.com/wp-content/plugins/super-forms/uploads/php/files/c1f6344cf97875f42c605ac5e07ea00c/55833679967.pdfIn PDF document text
    • http://cgt-fo-csc.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160725fa8eac3a---lutonaruzebinaxe.pdfIn PDF document text
    • https://fmpride.com/wp-content/plugins/super-forms/uploads/php/files/f118b059963a4318c02e8be12b8e8053/25545358525.pdfIn PDF document text
    • https://dermo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a6fd59e607---9169983512.pdfIn PDF document text
    • http://hoinhikhoavn.com/img/files/lukixenaliwetiwamigo.pdfIn PDF document text
    • https://xn-----6kcabagcgfjsxjciriy6alkh6a7aqk.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/99b3ef44850f20b873985e12f6be7230/64898853405.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000122f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x122F4 17372 bytes
SHA-256: 8de82a92bd047433e8ae0c6f4555a6bb0c3612006b37d43917c3cbd83aba1957
font_01_sfnt_off00014ff9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14FF9 10876 bytes
SHA-256: e52a7730dc073687e7f86b0f8a662d69f3e553affc92bb56886415d082495c95
font_02_sfnt_off000168f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x168F9 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.