Malicious PDF — malware analysis report

Static analysis result for SHA-256 109095c0ed80c880…

MALICIOUS

PDF

107.6 KB Created: 2021-08-17 06:50:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 5e0b54eee9b20c55cd5c814d75c4364e SHA-1: dc40913ecf5151cfc969cf1f211af2f1b1728219 SHA-256: 109095c0ed80c8807e71539a5823fbd4bce4ce1675dbdc6c2f6ae9450eeae9ce
224 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

This PDF file was flagged by multiple heuristics as malicious, including ML classification and ClamAV detection. It impersonates Microsoft and presents a download button, directing users to a URL that is likely a phishing or malware distribution site. The document body is heavily obfuscated and appears to be generated content rather than user-readable text, further indicating malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 9

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://queure.ru/uplcv?utm_term=myob+accountedge+pro+v15+download.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=myob+accountedge+pro+v15+download PDF link annotation
    • http://fortlauderdalelimorental.net/wp-content/plugins/formcraft/file-upload/server/content/files/160c8e7c3f1afe---68752866840.pdfIn PDF document text
    • http://www.fsnn.se/wp-content/plugins/formcraft/file-upload/server/content/files/160a4147d2e752---52000028834.pdfIn PDF document text
    • http://barbusci.it/maisUserFile/file/35692687865.pdfIn PDF document text
    • http://ufnk.fr/app/webroot/files/file/55442910816.pdfIn PDF document text
    • https://thetitangroup.ca/wp-content/plugins/super-forms/uploads/php/files/a96db62bd9dde901a73ec9ae0962c869/47323940801.pdfIn PDF document text
    • http://ambulatorioveterinariorigolon.eu/userfiles/files/47184371506.pdfIn PDF document text
    • http://wuxihemei.com/ckfinder/userfiles/files/20210604_105621.pdfIn PDF document text
    • http://aroma-es.red/yamituki-n/uploads/files/lofolasuwebokid.pdfIn PDF document text
    • https://moma-restaurant.com/wp-content/plugins/formcraft/file-upload/server/content/files/160af980a53817---wikexitufuzapibuvuxipub.pdfIn PDF document text
    • http://www.uppld.org/wp-content/plugins/formcraft/file-upload/server/content/files/161118577ed2d6---mivujexixodabadagun.pdfIn PDF document text
    • http://reutlinger.pl/userfiles/file/2485422516.pdfIn PDF document text
    • http://topimmigrationlawyer.org/ckfinder/userfiles/files/11402257996.pdfIn PDF document text
    • https://vildmarksjagt.dk/userfiles/file/wosuvumakemifozudagimifuj.pdfIn PDF document text
    • https://www.booster-p.com/wp-content/plugins/formcraft/file-upload/server/content/files/16118c550bfc6c---26326528057.pdfIn PDF document text
    • http://xn--b1ahhafccpgkb2bxo.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/49a9a68d783713fdcdf67df18ba5217e/5167968257.pdfIn PDF document text
    • http://saludocupacionalpso.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/16114348d8e80b---29120159644.pdfIn PDF document text
    • https://championsforchildren.org/wp-content/plugins/super-forms/uploads/php/files/84c97b2b40e113d92254ce337677cf3f/zozazis.pdfIn PDF document text
    • https://duext.com/wp-content/plugins/super-forms/uploads/php/files/5b4a783e1ae396c32ff0f7d0d5ed70b5/46824759478.pdfIn PDF document text
    • http://firmen-bekleidung.at/userfiles/file/varevolofexifuroxoteb.pdfIn PDF document text
    • https://www.ikedatosou.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608af76bc77d8---pagag.pdfIn PDF document text
    • http://duplisite.com/userfiles/file/lomidepos.pdfIn PDF document text
    • http://cesmclassof68cheyennewy.com/clients/82478/File/71426425116.pdfIn PDF document text
    • http://oldtimerclub-thueringerberg.at/images/file/wedovezexifamoramupabe.pdfIn PDF document text
    • https://thealloywheelcentre.co.uk/wp-content/plugins/super-forms/uploads/php/files/c86b3916c78bce81e9aaf73ef858523c/texulosadavudes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012942.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12942 11112 bytes
SHA-256: e1b8c155ff838565e408b89518a9e19cfca2c94df8615d263400db0f7ff3417d
font_01_sfnt_off00014312.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14312 20844 bytes
SHA-256: f7badf55f4e5ccca04ebef84141f2afeffefd750b976c08447c000ec90cac225
font_02_sfnt_off000178e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x178E8 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off000190f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x190F5 3832 bytes
SHA-256: d7d627a765bab0f8978fdcf3b50b4eb1d79126d833ae9466c3f56b2659c19fed

Open this report in the interactive analyzer, or submit your own file for analysis.