Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c4106fe01f225ce…

MALICIOUS

PDF

100.0 KB Created: 2021-07-09 04:24:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 52d8d4121c62a835bc39905f88e91e6a SHA-1: 34b6d1d8d1e7d0feb540f0cbf8ff461e16cf20cf SHA-256: 0c4106fe01f225cea3951f0f0e3b6c1b19070630d13e856ad1b20422f016ad36
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many of which are hosted on compromised WordPress installations or disposable domains, suggesting a link farm or phishing lure. The presence of PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics further supports this. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9737

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.hcibatiment.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160a9206d37f27---47048505990.pdf
    • http://www.medicalalliedtraining.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6aba39ea0e---864913160.pdf
    • https://paklya.su/design/img/upload/file/musolidelaxok.pdf
    • https://retentionstudentexperience.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092aca7478a7---miwoxirimojiwilozigom.pdf
    • http://lidata.eu/files/vexulifevirole.pdf
    • https://ewms.vn/wp-content/plugins/super-forms/uploads/php/files/pehorjj46idbbomk2470kv2s67/dokinogakofiwujefetep.pdf
    • https://lesartsdansmonjardin.com/userfiles/file/20210524111003.pdf
    • http://stalmont.eu/userfiles/file/zaxajogujadegoweruv.pdf
    • http://ne-moloko.ee/wp-content/plugins/super-forms/uploads/php/files/685c763b728544a3429e086c8eb5e8af/rojegirorukigizemokulirom.pdf
    • http://air-ned.com/uploads/files/50673034036.pdf
    • http://17njl.com/userfiles/files/54163250815.pdf
    • https://petroblend.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608ea00a37831---76426554083.pdf
    • https://makeswebsites.com/clients/c/c8/c8c605999f3d8352d7bb792cf3fdb25b/File/2128094820.pdf
    • https://laser-arena.ch/wp-content/plugins/formcraft/file-upload/server/content/files/160987c35a4ca1---53044940043.pdf
    • https://buyafranchise.org/files/files/74209998008.pdf
    • https://pypconsultores.mx/userfiles/file/fezalovasodigutozu.pdf
    • https://universal4shipping.net/userfiles/file/nenuxidare.pdf
    • https://mrmusicfoundation.org/wp-content/plugins/super-forms/uploads/php/files/nr7tb490ep3c59b7c9et295dor/guvedivolov.pdf
    • https://www.hungarianassociation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d6ec554e43---16840683735.pdf
    • http://intechsol.kz/wp-content/plugins/formcraft/file-upload/server/content/files/1607249e4b83ac---7112843255.pdf
    • https://www.cdscabling.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16085491d1c368---38618399832.pdf
    • https://thriveelearning.com/wp-content/plugins/super-forms/uploads/php/files/0eef7974f5e400e517d95b941b463d93/xawemefaf.pdf
    • https://frontlinetherapist.com/wp-content/plugins/super-forms/uploads/php/files/d44df097b2a4353a2e16b6a494cb17ff/80585546857.pdf
    • http://dom-nenilovo.ru/wp-content/plugins/super-forms/uploads/php/files/b1427b8237f1cff5235e58b4daccaebf/34751003549.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/GLLx1DTH0VQ/uplcv?utm_term=introduction+in+marathi
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010084.bin
6acfee09aef641cf1ff5e5679265f55e48ebaea790b912e288e7d36645c29ea2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10084 19812 bytes
font_01_sfnt_off0001340b.bin
81e61d6faca6bf737b025215d52c143651ca7935b1c395b03e6f93e4e17e876e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1340B 2012 bytes
font_02_sfnt_off00013d41.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D41 16792 bytes
font_03_sfnt_off00015552.bin
7d15b2d6d265aaca51dda18faee70a1b8fa9d95ed54cb111fb0895789092f9ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15552 16312 bytes
font_04_sfnt_off00016b5e.bin
8e273043ce6fa481c0bad1a68669f4727c53f5f01dea6e09af3018031434fc3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16B5E 10340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.