Malicious PDF — malware analysis report

Static analysis result for SHA-256 13f83a0a46b2033a…

MALICIOUS

PDF

100.8 KB Created: 2021-06-27 02:52:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 72a542a101f2799e8313292978b8c717 SHA-1: 973465ea822c895c9abb3d57017fb3ce7b82566f SHA-256: 13f83a0a46b2033aee59ee0bf4240c3e0a500a7c057010ce3b17381ed3e1d119
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It functions as a link farm, with numerous embedded URLs pointing to compromised CMS upload directories, likely serving as a distribution point for further malicious content. The presence of multiple external URIs and the structure of the PDF suggest an attempt to lure users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9929

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loskutova.site/wp-content/plugins/super-forms/uploads/php/files/c334cd3689ac40ecec446497691e6373/88399986225.pdf In PDF document text
    • https://patriot.ch/wp-content/plugins/super-forms/uploads/php/files/03d3dhhp6q94ni6l8ho3l0t42c/fijuvojup.pdfIn PDF document text
    • http://midiabyz.com/wp-content/plugins/super-forms/uploads/php/files/3ef068b3ec5b96bf52cfe6819b148c3d/wofetefutin.pdfIn PDF document text
    • https://www.hinogas.com/wp-content/plugins/super-forms/uploads/php/files/sh0cn8pb0jf27f26d515f509gq/91895298567.pdfIn PDF document text
    • https://www.andyselfstorage.co.uk/wp-content/plugins/super-forms/uploads/php/files/8aeqrnfjmceav8hh8fo43k3e19/fiwodatogekijoxefefe.pdfIn PDF document text
    • http://innovatepc.com/userfiles/file/33380707884.pdfIn PDF document text
    • https://www.unicodesystems.com/wp-content/plugins/super-forms/uploads/php/files/5i2117u5kb9uscp94fs2pai1n4/53169288099.pdfIn PDF document text
    • http://baloneacessorios.com/_upload/file///worefewuzusuwixovupesit.pdfIn PDF document text
    • http://nutricion-intravenosa.com/wp-content/plugins/super-forms/uploads/php/files/08c075d89d0da898422a3674d4bc694b/gilamisiralaged.pdfIn PDF document text
    • https://provisionsinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bdaa5f89504---kasaraza.pdfIn PDF document text
    • http://primaneighbors.com/userimages/fulekelarabeja.pdfIn PDF document text
    • https://ethiquedevelopers.com/wp-content/plugins/super-forms/uploads/php/files/2e453fab7419814e1cd48c9b549ccda9/turosobuvemisefamomezezuv.pdfIn PDF document text
    • https://rjiminfra.com/wp-content/plugins/super-forms/uploads/php/files/2c1866aace23cafd68a757dcdc56726b/40017198967.pdfIn PDF document text
    • https://www.qlsny.com/wp-content/plugins/super-forms/uploads/php/files/1ded823e048ba122a22f27b69e582344/lawixufotak.pdfIn PDF document text
    • http://ecohost.ru/pics/images/file/78849230042.pdfIn PDF document text
    • https://airtelco.com/data/users/_/email/files/pefusudosumagubur.pdfIn PDF document text
    • http://dmscsmartlifeblog.com/userfiles/files/rabaju.pdfIn PDF document text
    • http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092a346e0149---dulojumidujazejeso.pdfIn PDF document text
    • https://www.mnspineandsport.com/wp-content/plugins/super-forms/uploads/php/files/57350458e08934e2064a54e2e6b2ab27/xexezapife.pdfIn PDF document text
    • https://alternativecarrepair.com/userfiles/file/gopazojuvukarepujiram.pdfIn PDF document text
    • https://heykidsletscook.info/wp-content/plugins/super-forms/uploads/php/files/b7f6cd758cd0a819cd941cd72aa328d1/dazumanuxuxakewutafev.pdfIn PDF document text
    • https://doellefjelde-mussemarked.dk/images/newsmail/file/kojiz.pdfIn PDF document text
    • http://ersatzmonitor.de/userfiles/file/gekivizakotodupem.pdfIn PDF document text
    • http://sciencevier.com/wp-content/plugins/formcraft/file-upload/server/content/files/160767074e0907---naxedimem.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/A3Ryygt5BCM/uplcv?utm_term=nominal+ordinal+interval+and+ratioPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000126c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126C9 18256 bytes
SHA-256: a935f6f9bceeb78c33d39282f60f67dbe6a1bc7181999d27f1daba03f6944b47
font_01_sfnt_off00015702.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15702 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00016f19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16F19 10284 bytes
SHA-256: d0a4ac9119e5cbeede96d07366a83bed90d81a68a2a734403941f10a491ab316

Open this report in the interactive analyzer, or submit your own file for analysis.