Malicious PDF — malware analysis report

Static analysis result for SHA-256 15c61b9107948285…

MALICIOUS

PDF

94.0 KB Created: 2021-09-01 22:02:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: f8314cd86530c86bf3af394e2782ecc3 SHA-1: 9abe75214141ea4d9df485b9e44d62854c9be1db SHA-256: 15c61b91079482854483d8c3a73e1bdce51d81599f3d24c900564894f36a54b1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains numerous links, many pointing to compromised WordPress sites, suggesting it functions as a link farm designed to redirect users to malicious content. The presence of 'utm_term' parameters in some URLs indicates a potential phishing or tracking campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://allytemp.ru/uplcv?utm_term=loom+bands+step+by+step PDF link annotation
    • https://pikewallis.no/wp-content/plugins/formcraft/file-upload/server/content/files/16089b57ce6693---mewigelas.pdfIn PDF document text
    • http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16072cc0eb4a8b---82568492928.pdfIn PDF document text
    • http://vigova.vn/Images_upload/files/57764834350.pdfIn PDF document text
    • http://ansing.nl/userfiles/file/fuzukon.pdfIn PDF document text
    • https://stewsites.com/wp-content/plugins/super-forms/uploads/php/files/8e82c716d065bf05df7dc5a9c80a1872/60450641547.pdfIn PDF document text
    • http://www.majoriscambio.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1611212bf5cc40---mipubumane.pdfIn PDF document text
    • https://engravestone.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073e5aac094a---51801414980.pdfIn PDF document text
    • https://hmjrgoldhockey.org/wp-content/plugins/super-forms/uploads/php/files/d1257f9067acddd704377d3b90a0d354/rakefurivosowap.pdfIn PDF document text
    • https://amerismithenterprises.com/wp-content/plugins/super-forms/uploads/php/files/43f5f2538a4294b5206dea431a4adf5d/davivopesatifebifif.pdfIn PDF document text
    • http://studioguidobarbieri.it/userfiles/files/61804142780.pdfIn PDF document text
    • https://balance-global.com/wp-content/plugins/super-forms/uploads/php/files/9stvju1kfvnvhqq991kvhlvdrf/89527011065.pdfIn PDF document text
    • http://webscape.co.bw/wp-content/plugins/formcraft/file-upload/server/content/files/160a2e2ef9cbc8---34548363405.pdfIn PDF document text
    • https://www.ezhealthcheck.com/wp-content/plugins/super-forms/uploads/php/files/jtla2ui71t3dqrb73294qokhcl/12045865711.pdfIn PDF document text
    • http://vititanon.com/user_img/files/likodoninavoruwibab.pdfIn PDF document text
    • http://ytbozhuo.com/upload/file/200117079135.pdfIn PDF document text
    • http://www.lbf-cosmetics.com/website/wp-content/plugins/formcraft/file-upload/server/content/files/160dae47b70e0b---bazuzavidib.pdfIn PDF document text
    • https://anzmrrn.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a7cdd5996e1---23635851703.pdfIn PDF document text
    • http://alpanelektrik.com/depo/sayfaresim/file/xujevuxovomugezakovever.pdfIn PDF document text
    • https://www.singaporemedicalclinic.com/ckfinder/userfiles/files/valobupijejawebavo.pdfIn PDF document text
    • http://ylpcl.com/ckfinder/userfiles/files/93149932134.pdfIn PDF document text
    • http://www.x454.com/wp-content/plugins/super-forms/uploads/php/files/0cbjmt71gmn2tc4o3n3v2vd386/54562597758.pdfIn PDF document text
    • http://haai.org/upload/file/badopowasamomosilizaxeri.pdfIn PDF document text
    • http://serendipityorlando.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607730ed65a27---xofebapasuburuxalefasup.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B99 10528 bytes
SHA-256: 09d17769b8c9e18cc642a51f72e196f595aeba6bdf246c37dbc7494a241d23b2
font_01_sfnt_off00012361.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12361 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013b73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B73 18196 bytes
SHA-256: 7393bce0a61cc12ef3185a52b55e6432edc6375f4887e01fca0655a47a5bd48f

Open this report in the interactive analyzer, or submit your own file for analysis.