Malicious PDF — malware analysis report

Static analysis result for SHA-256 095d270dd8caa415…

MALICIOUS

PDF

90.5 KB Created: 2021-08-02 17:28:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 0186c587f9b7269de647892b9a1c9204 SHA-1: 674d6418bfba84f132718c92badd9ec62034bc9e SHA-256: 095d270dd8caa41555a5371780eff2aa792e4f878261ff376e759e43d9a4de01
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by ClamAV as a phishing trojan and by an ML classifier with high confidence. It contains numerous links, many pointing to compromised WordPress sites, suggesting a link farm or phishing lure. The embedded URLs likely lead to further malicious content or phishing pages, indicating a multi-stage attack. No scripts were extracted, but the overall structure and URL distribution strongly suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9906

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/uplcv?utm_term=chef%27s+star+milk+frother+manual
    • https://mediabandit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a931ccce6f---xewim.pdf
    • http://world-spa-resorts.com/dok/lajikivuzaw.pdf
    • https://lacecinella.com/writable/public/userfiles/file/pagabeluroreremawix.pdf
    • https://theurbanthinktank.com/files/ripeguvufuvasidu.pdf
    • http://camping-du-lac-dijon.com/fichiers/38389432860.pdf
    • https://study-go.info/wp-content/plugins/super-forms/uploads/php/files/c2262581adad694802ade2ddd7c8644a/61341740123.pdf
    • https://bselink.com/userfiles/file/47136621776.pdf
    • https://kantankacreative.com/wp-content/plugins/super-forms/uploads/php/files/2891a1fe32f030a5e83d3a9b44866732/34253267729.pdf
    • http://www.skupp.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160db7bd4392ec---fegige.pdf
    • http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16105edf5d6a08---rijabimavuwisadipipa.pdf
    • http://www.aadhar-interior.com/userfiles/file/82594073357.pdf
    • http://plncse.hu/php_data/file/nezimul.pdf
    • http://www.mvdisposal.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad5f9592c08---xuborimawageg.pdf
    • https://muratay.nl/userfiles/file/zemuliwixalobutuxave.pdf
    • https://discoverapartmentsforrent.com/wp-content/plugins/super-forms/uploads/php/files/78122ef38341fbd774a984985aed0364/zasowisakuxew.pdf
    • http://www.casasemio.com.br/ckfinder/userfiles/files/fotikuvowarudob.pdf
    • https://www.allterra.group/wp-content/plugins/super-forms/uploads/php/files/241a0dcfacb4cee542775e660489c2c7/93570306873.pdf
    • https://www.advids.co/wp-content/plugins/formcraft/file-upload/server/content/files/1606d01226a88c---lerofufalutowevu.pdf
    • https://nationalcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c68fb887163---94288920174.pdf
    • https://hsegroup.ru/wp-content/plugins/super-forms/uploads/php/files/4cc56t2h6b3ej3amnh425dump7/rozeguk.pdf
    • https://amatnieks.com/pictures/image/jazefarexonazonip.pdf
    • http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1606ee52ac2c14---52491754293.pdf
    • http://jockmurray.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a707e0042d---37721591649.pdf
    • https://sdyh.gr/wp-content/plugins/super-forms/uploads/php/files/4rnp2ee4384ugp0h9duj9sl3a7/79485478253.pdf
    • https://egca.fr/userfiles/file/mivosukonidi.pdf
    • https://hyundainhapkhau.vn/upload/files/54412739182.pdf
    • https://xn--80apefbdm9ah5g.xn--p1ai/userfiles/saxenekegurale.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fdde.bin
0dfe1d6bddc5a2c4ca712013ab89c721159e09e37ad900c1cba466f20acbd393		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDDE 17436 bytes
font_01_sfnt_off00012b46.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B46 16792 bytes
font_02_sfnt_off0001435d.bin
5dc4acc03979f0b40f4f8a39d628ab2fbd023b122402e2d21c0da57183bb869c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1435D 10736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.