Malicious PDF — malware analysis report

Static analysis result for SHA-256 085c880e1048555a…

MALICIOUS

PDF

84.4 KB Created: 2021-07-16 22:19:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 6d2c4c3deb8854f2e3832747066a1941 SHA-1: 1c6be3e98d47193a6515ce98a3f70caa6b110ac9 SHA-256: 085c880e1048555a384e7ee9e0587e93d922a5c32b0238c1f9d78a6053d54285
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating a malformed exploit stream and a link farm pointing to compromised CMS uploads. The PDF contains numerous URLs hosted on various websites, many of which are likely part of a phishing or malware distribution scheme. No scripts were extracted, but the PDF structure itself is indicative of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH
    A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.julitolaschools.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c92a9755d19---viwugaled.pdf In PDF document text
    • https://munord.com/wp-content/plugins/super-forms/uploads/php/files/0e07c9d6f89233b24e87deeb1c05b95e/gukukebobipuxunedadap.pdfIn PDF document text
    • https://transcendenceit.com/wp-content/plugins/super-forms/uploads/php/files/d9bdd1fcfee1c15ce104112a99af13bf/63262827977.pdfIn PDF document text
    • https://winston-woodward.com/wp-content/plugins/super-forms/uploads/php/files/d3e30ff5a4acc39eaed19abb81e6b973/24986026077.pdfIn PDF document text
    • http://kuhomania.ru/ckfinder/userfiles/files/komapunifenodanewiwer.pdfIn PDF document text
    • https://www.ferienhof-schneider.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608222f3850e3---ridurozunisi.pdfIn PDF document text
    • http://ildungrice.com/fileupload/fckeditor/file/mosekifitedi.pdfIn PDF document text
    • https://ahi.com.ua/wp-content/plugins/super-forms/uploads/php/files/93e631e6dd81ae070c0b7f3ed6114104/pojumogadera.pdfIn PDF document text
    • http://paramountswimwear.com/userfiles/files/jezipimi.pdfIn PDF document text
    • https://anzmrrn.org/wp-content/plugins/formcraft/file-upload/server/content/files/16085740a1709a---50029866129.pdfIn PDF document text
    • https://italvaping.com/file/mopewolerezubupu.pdfIn PDF document text
    • http://eurolocal.info/sites/default/files/images/file/3939801285.pdfIn PDF document text
    • https://wccia-vastu.com/wp-content/plugins/super-forms/uploads/php/files/e44573ce548a690e96d722f7ae0d30b1/6126680499.pdfIn PDF document text
    • https://holyfamilyhospitals.com/ckfinder/userfiles/files/99303639052.pdfIn PDF document text
    • http://vudafrique.com/wp-content/plugins/super-forms/uploads/php/files/6692dfaa4e202f075cbbc3b768cb1c2a/36078081658.pdfIn PDF document text
    • https://baodinhsolar.com/wp-content/plugins/super-forms/uploads/php/files/67gdrrhqavm8ieq6csoh3j5lpe/24294222257.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160de6f0f2a06a---ziwimetuvos.pdfIn PDF document text
    • http://ottotech.center/userfiles/file/44042511968.pdfIn PDF document text
    • https://dedywiredja.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608266e80bc39---punozelukidex.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ba5ae2a610d---powofoloxon.pdfIn PDF document text
    • http://steclotildehorton.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160a33ca78e150---70111705874.pdfIn PDF document text
    • http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c84f72eaa68---27398077531.pdfIn PDF document text
    • http://www.goataxiservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609058465a905---66408766005.pdfIn PDF document text
    • https://www.isnb.co.uk/wp-content/plugins/super-forms/uploads/php/files/93a1c80ab107c0deac388c14715e0a80/70300805301.pdfIn PDF document text
    • https://nam.it/wp-content/plugins/formcraft/file-upload/server/content/files/16077484cea44f---29404180551.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=marinade+for+chicken+kabobs+without+soy+saucePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e757.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE757 11052 bytes
SHA-256: 009611aa3cdde0ec656f93bc8ddd89be63098ba7f00b8f2db4f345cae7b565b8
font_01_sfnt_off00010117.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10117 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00011929.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11929 16648 bytes
SHA-256: 00fd3a0ab742c7352e796d11e5c5101839c1c509e7970d02165dda545addf6d8

Open this report in the interactive analyzer, or submit your own file for analysis.