Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b6bfa8619bba6cb…

MALICIOUS

PDF

80.4 KB Created: 2021-09-08 06:46:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 53b7e51f73cfc6b741f20daca2da372e SHA-1: 7c3210e2f7a26238fd7eaa158233f4c4da157bc1 SHA-256: 1b6bfa8619bba6cba1c23c4ac042cfb7dfe10b31d0be8668f29ad25acac592c0
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample contains embedded JavaScript and numerous external URIs, many of which point to compromised websites or disposable hosting, suggesting a phishing or malware distribution attempt. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment. The embedded JavaScript likely facilitates the redirection to these malicious sites.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3367

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=collins+easy+learning+mandarin+chinese+dictionary+pdf PDF link annotation
    • http://saringkarnwood.com/UserFiles/file/jetoxepatolazuvisekitadup.pdfIn PDF document text
    • http://alnadaoil.com/userfiles/file/68625218868.pdfIn PDF document text
    • http://www.idukkidiocese.org/files/js/ckfinder/userfiles/files/xobowalinemedel.pdfIn PDF document text
    • http://bernardthevenet.fr/ckfinder/userfiles/files/nikarigugegeriban.pdfIn PDF document text
    • https://tfnd.org/wp-content/plugins/super-forms/uploads/php/files/7473dd3e61bcdf5c144fd4d607c34094/nomivuvifakaronu.pdfIn PDF document text
    • https://webhostmurah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bf4f7a6d20b---66240158101.pdfIn PDF document text
    • http://xn--80aagkbrca3apkgkee0a1bi.xn--p1ai/ckfinder/userfiles/files/30133749708.pdfIn PDF document text
    • https://inijariku.com/ckfinder/userfiles/files/53592486024.pdfIn PDF document text
    • http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b4272e5d750---82392402661.pdfIn PDF document text
    • http://www.mtpartnersfl.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c04b60eba9---jaxid.pdfIn PDF document text
    • http://expertcomptablecourreges.fr/michel_courreges/userfiles/file/xusudebaxa.pdfIn PDF document text
    • http://fine-trading-knotwork.de/uploads/media/zusovamupefaziwimubera.pdfIn PDF document text
    • http://ybshajiang.com/userfiles/file/2021-08-29/210829214809813161fosk6tm7bfjg.pdfIn PDF document text
    • https://apparel.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/a18e54c636ef8077496876ee9690b1fc/gofasogetugelim.pdfIn PDF document text
    • https://tkpmission.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c97009ccfc1---xadunijejodabedigefetof.pdfIn PDF document text
    • http://peak-experience-japan.com/images/blog/file/verezokunijominul.pdfIn PDF document text
    • https://ecoinkworld.com/wp-content/plugins/super-forms/uploads/php/files/6e2836a27c0e3379f694e0811be4e296/86235589103.pdfIn PDF document text
    • https://jiptv.nl/wp-content/plugins/super-forms/uploads/php/files/sh2a8doq0anlo83o47opdq1dte/53594262652.pdfIn PDF document text
    • https://eastmanllc.net/ckfinder/userfiles/files/39620797067.pdfIn PDF document text
    • http://ebiocell.com/uploadfile/file///2021080315145767.pdfIn PDF document text
    • http://konberdbio.com/upload/files/65280934393.pdfIn PDF document text
    • https://www.drserapkagan.com/wp-content/plugins/super-forms/uploads/php/files/pll70s1nsl38e1b3o3kjgagu7a/sotuzupojas.pdfIn PDF document text
    • https://carmelocuritiba.com.br/ckfinder/userfiles/files/podawamolinu.pdfIn PDF document text
    • https://www.electriclighting.com/wp-content/plugins/super-forms/uploads/php/files/aa703f074811d896ca09f64a62303475/25837619222.pdfIn PDF document text
    • https://denizlihorozu.com/resimler/files/woluwolidavofigevuwitutov.pdfIn PDF document text
    • http://crystalnymph.by/wp-content/plugins/super-forms/uploads/php/files/c6da5def906a98f941eeef1b91a97982/15214603551.pdfIn PDF document text
    • http://bubblesoflove.net/wp-content/plugins/formcraft/file-upload/server/content/files/1606ffb55694e0---bumowagob.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d747.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD747 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000ef59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF59 19460 bytes
SHA-256: 816171b85ca1fe34a763c8fb8a865ef7c711c277f0e84885de051e0823a177e6
font_02_sfnt_off0001222f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1222F 11212 bytes
SHA-256: b988ad67e851fe30d3b070627ff13b44048382d8449c926e3aab24a1d58300ca

Open this report in the interactive analyzer, or submit your own file for analysis.