Malicious PDF — malware analysis report

Static analysis result for SHA-256 03c65053ea2833bc…

MALICIOUS

PDF

86.3 KB Created: 2021-06-27 23:13:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 39b6fe5b8064ba7525ba412dc61349ba SHA-1: 07b7c73d88911f6d5c0892d50935860ddb7521e8 SHA-256: 03c65053ea2833bc14e34790c2279803b9ff04912098c2371178ee8b9891e619
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous URLs pointing to compromised WordPress upload directories, suggesting a phishing or malware distribution scheme. The presence of multiple links on disposable hosting and the use of UTM parameters further support this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xn--80akij1ajew.xn--p1ai/wp-content/plugins/formcraft/file-upload/server/content/files/160aaa29c46db1---zadijejenepaguw.pdf In PDF document text
    • http://kwik-it.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160ac910a21b98---26753973043.pdfIn PDF document text
    • https://vmwarts.com/ecovic/file/27513357455.pdfIn PDF document text
    • https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a967d01dd29---392025370.pdfIn PDF document text
    • https://dermo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609860b8804ab---saferuxibubesi.pdfIn PDF document text
    • http://www.ellisrasbetonwerke.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16074cfed03d23---lidatixam.pdfIn PDF document text
    • http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607af5a0c654a---wisatafudenoxikatiwuv.pdfIn PDF document text
    • http://wo-kop.pl/userfiles/file/43262294458.pdfIn PDF document text
    • http://ventilyatsia-v-sochi.ru/ckfinder/userfiles/files/81115188571.pdfIn PDF document text
    • https://sckstone.com/wp-content/plugins/super-forms/uploads/php/files/ffa4cb16d0777a3d95dc0d89a2b03c9a/lusonepijusitikudan.pdfIn PDF document text
    • http://mulroyenvironmental.ie/userfiles/file/89062409975.pdfIn PDF document text
    • http://metzpaintings.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095d4e5830c4---58135372587.pdfIn PDF document text
    • http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608929071a546---68888181444.pdfIn PDF document text
    • https://www.a2zmedical.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160b229d78057a---mideworabaf.pdfIn PDF document text
    • http://gsoam.ge/wp-content/plugins/formcraft/file-upload/server/content/files/160b423c0f2ed8---6131267141.pdfIn PDF document text
    • https://vizzzio.ru/wp-content/plugins/super-forms/uploads/php/files/6467ce7de7de4ff9b575906e1f709f88/guninelalixezufu.pdfIn PDF document text
    • https://bbensonmft.com/wp-content/plugins/super-forms/uploads/php/files/824c8634a4cc6324b12ea5519d9fc4fe/rusijazutitupot.pdfIn PDF document text
    • http://itssilvertime.com/clients/2/24/24efe347a73a8ce028152bf895bc11a7/File/2254741119.pdfIn PDF document text
    • http://villa-carlshorst.de/sites/default/files/file/xiwuju.pdfIn PDF document text
    • https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/afjtjnl5j9b9evguf3tpnpa4f5/gudukimazob.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=poisson+process+conditional+probabilityPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e202.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE202 18140 bytes
SHA-256: dcb02c741a12344fbd5ec3eb038286ab01cf185029591197c66489891a30a946
font_01_sfnt_off00011214.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11214 1624 bytes
SHA-256: 1ffddb75bdc19ece25e90d0f26fa4011bfdd02cac2bd27c1d82de11d19d32c7e
font_02_sfnt_off00011aca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11ACA 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off000132e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x132E1 10760 bytes
SHA-256: bfd4382e9e38a56cceaa2da6e81b1296aa2f8c3173ce03c701deeec5dd9d13d5

Open this report in the interactive analyzer, or submit your own file for analysis.