Malicious PDF — malware analysis report

Static analysis result for SHA-256 07963cac7fbfc07a…

MALICIOUS

PDF

92.6 KB Created: 2021-06-28 23:59:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 87314c5e09747e5caf9a8496187577ae SHA-1: fb193679d42acaed13d982e66334d45b08fe2521 SHA-256: 07963cac7fbfc07a2a946709c50218be8516eac4e99ee6abd16575731660989e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, containing numerous URLs pointing to compromised WordPress sites, likely serving as a distribution point for phishing or malware. The presence of external URIs and link farm heuristics strongly suggests a malicious redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9836

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=in+the+mouth+of+madness+stream
    • https://www.gsccn.it/wp-content/plugins/formcraft/file-upload/server/content/files/16082b61de2ca6---ruzuzumanulevifavumojaji.pdf
    • https://dungcuruamui.com/wp-content/plugins/super-forms/uploads/php/files/3hjaa6tecmbv3vb7llgjgntdnj/lifizabifefafubatekivu.pdf
    • http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160843a705c771---4676810051.pdf
    • https://bursakaynak.com/userfiles/file/wopadalazewozufujub.pdf
    • https://spectrumohio.com/wp-content/plugins/super-forms/uploads/php/files/3a1465a4567fa152872fb3e813c8c7f1/balafezifovew.pdf
    • https://solarconsulting.org/wp-content/plugins/super-forms/uploads/php/files/6b205f7ae87afc9e9e03d5256613227f/tusaduwunomozomavesojulox.pdf
    • http://hndgyl.com/v15/Upload/file/20216131716223208.pdf
    • https://sharzh-ufa.ru/wp-content/plugins/super-forms/uploads/php/files/36a1ee2abc97ce811adc4e2b5469a775/29845324681.pdf
    • https://archcosmeticstudio.com.au/wp-content/plugins/super-forms/uploads/php/files/d367b1235b2e0197435971d162691228/xozuvitupepufetubawomuxik.pdf
    • http://getawaynewzealand.co.nz/wp-content/plugins/formcraft/file-upload/server/content/files/160a2d7ea89201---89003650478.pdf
    • https://europeancustomtailor.com/wp-content/plugins/super-forms/uploads/php/files/0053bfd19158bdc5beed7d1b45eaec25/24338087541.pdf
    • https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c891f30bf3---82017824111.pdf
    • http://j-club.eu/userfiles/file/wotaxojoxefaxirokusu.pdf
    • https://www.treehousecare.org/wp-content/plugins/formcraft/file-upload/server/content/files/160738428ab3f7---fusuwisunoxabotaja.pdf
    • http://sillajen.com/fckeditor/_upload/file/woritakurulo.pdf
    • https://sygimportaciones.com/wp-content/plugins/super-forms/uploads/php/files/ing1bh15l48l2u7gb8su3fc1ug/fufexipekaturalipapaxezop.pdf
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/gnaq33h8p6g9tnactc6nhoba45/jutitadoreropokite.pdf
    • https://k-kompany.ru/wp-content/plugins/super-forms/uploads/php/files/8626b6a893447702d4ab3f16513ef985/pasajibugamaxilazuvepet.pdf
    • https://baxsporthorses.com/userfiles/file/7960911874.pdf
    • https://aannemingsbedrijfbarthulsbosch.nl/userfiles/file/jodolerujigakofadagukak.pdf
    • https://davidfoleyinc.com/userfiles/file/47853951682.pdf
    • http://minerva-collection.net/files/files/jiranuwuboruwixezugurup.pdf
    • http://extracam.es/app/webroot/arxius/file/gedasusepedegulupepawaf.pdf
    • https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/ccd99ec1a5d5d89abf7c7ce01171048d/sasirenafefelalanuwedi.pdf
    • http://brownewingfamily.com/clients/a/a4/a4d7a48ed280e719b438ae57db99af5e/File/sijexajufedomozure.pdf
    • http://phenix-security.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16072c7437bb63---teretorolimiteriw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efec.bin
97e3f73a58ccdd4784c9ae1678d9f90717e6b6d0c87c36bf93adb8865ef65ebd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFEC 16192 bytes
font_01_sfnt_off00010579.bin
b4987b526565f0c58b5682a93533a86dfae55727786b8a309a7e36545076830c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10579 10532 bytes
font_02_sfnt_off00011d3c.bin
03a2bbb3bfd3935b7ad2b916ea89ebb3fb791c2c677ea53e80d5e9fdf08a2006		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D3C 17988 bytes
font_03_sfnt_off00014c67.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14C67 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.