Malicious PDF — malware analysis report

Static analysis result for SHA-256 0dfeb972e8ac91d0…

MALICIOUS

PDF

100.7 KB Created: 2021-07-08 01:48:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: c62ed0d22e4b0f74fc1bc9106cbdc8cd SHA-1: dcef892de5e6890036f5f43a168720fa38afc07a SHA-256: 0dfeb972e8ac91d050be2f10a9c9eb4138ec1b3f685e88291a24073c7d9630fb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristics reveal it functions as a link farm, directing users to multiple external websites, some hosted on compromised CMS platforms. The embedded URLs suggest a phishing or malware distribution scheme, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9803

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/uplcv?utm_term=beta+blockers+for+anxiety PDF link annotation
    • https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/2140bdca989ec00b3b1d25df1e2b2e15/80757911567.pdfIn PDF document text
    • http://photographybynami.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608536b112cd8---19434874784.pdfIn PDF document text
    • http://ausafe.net/images/art/files/24061265909.pdfIn PDF document text
    • https://roc.mn/uploads/files/vudunasiximepubug.pdfIn PDF document text
    • https://psychologgia.pl/Upload/file/58882293405.pdfIn PDF document text
    • http://getawaynewzealand.co.nz/wp-content/plugins/formcraft/file-upload/server/content/files/160b105e2a71f6---88236593496.pdfIn PDF document text
    • http://info56.ru/userfiles/file/madavunodalu.pdfIn PDF document text
    • https://thetitangroup.ca/wp-content/plugins/super-forms/uploads/php/files/30be5e58d4ab0278680a03d2b0455745/latonovefofunebinuzef.pdfIn PDF document text
    • http://www.colegiometa.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/1608886c8570a7---tilexokuxema.pdfIn PDF document text
    • https://www.karavanlakesfet.com/wp-content/plugins/super-forms/uploads/php/files/4892d453897fb27628d31b9081679154/63016279245.pdfIn PDF document text
    • http://systemsbiology.at/uploads/assets/file/78867915301.pdfIn PDF document text
    • http://allprintusa.com/admin/images/file/98391487249.pdfIn PDF document text
    • https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/be153943d93997a9f4237fa20e4c7d12/85962071848.pdfIn PDF document text
    • http://oio.cn/uploadfiles/files/47536651953.pdfIn PDF document text
    • http://ajivikafinance.com/userfiles/file/saxopifupikabusu.pdfIn PDF document text
    • https://mymovingestimate.com/wp-content/plugins/super-forms/uploads/php/files/d65efc8cd32bbd15b0ac99cde6dfe1bd/likibowuxukapegabufunon.pdfIn PDF document text
    • http://www.risingstars.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1607359e1cfaba---gaxemurazurevogolelan.pdfIn PDF document text
    • http://www.birapart.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e55a640681---tokowared.pdfIn PDF document text
    • http://redactron.com/userfiles/file/zabixevesadubatedir.pdfIn PDF document text
    • https://technok.cz/wp-content/plugins/super-forms/uploads/php/files/7d9450f61fecedd26c46b2af8760d930/16799646705.pdfIn PDF document text
    • https://www.frankcapassoandsons.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad8d7e88a04---68922686834.pdfIn PDF document text
    • http://jrmhandling.nl/upload/file/76601824052.pdfIn PDF document text
    • https://hoovermaids.com/wp-content/plugins/super-forms/uploads/php/files/975161e2590b608554c15e7ccca4b298/jabuxaxedebokiliwenonaxa.pdfIn PDF document text
    • http://stuarteisbrucklaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/33508093351.pdfIn PDF document text
    • http://nutronicltd.com/userfiles/file/90623553157.pdfIn PDF document text
    • https://acryl-bg.com/userfiles/file/70991199186.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000126c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126C3 17324 bytes
SHA-256: d880ead2b5ecd3114a578f650bc15ddc1e895427fcfb23c7b7c3fbbdd171fda1
font_01_sfnt_off00015445.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15445 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00016c5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16C5C 10832 bytes
SHA-256: a43fd5adcfbf61e19880049cba15a7c9ab0d5abe750c71444f9f77dabee53e6e

Open this report in the interactive analyzer, or submit your own file for analysis.