Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c1768523d43e324…

MALICIOUS

PDF

89.0 KB Created: 2021-08-07 16:32:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-22
MD5: 893c8ea001c9373b5f159279197b58a3 SHA-1: 2a58c58d954b9afacd19295cdc777f8944353940 SHA-256: 1c1768523d43e32410086ff0f31e8a80b5b038f3866d051edbf2693efcdd6bf8
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and numerous URLs, many of which point to compromised WordPress sites or disposable hosting, suggesting a link farm designed to lure victims. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware delivery via the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9877

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://webinaris.blog/ckfinder/userfiles/publics/files/88554607327.pdf In PDF document text
    • http://www.cuadernos.in/wp-content/plugins/formcraft/file-upload/server/content/files/160f9a4395233f---42422892257.pdfIn PDF document text
    • https://happycustomerservice.com/wp-content/plugins/super-forms/uploads/php/files/b918fcad11ea966b97673507a58ac53e/fonuxusazutarudidaxu.pdfIn PDF document text
    • https://keiba-like.biz/js/ckfinder/userfiles/files/xosesanukavonapis.pdfIn PDF document text
    • https://www.a2zmedical.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160790b5cbffc7---91153832400.pdfIn PDF document text
    • https://allcreaturesinc.com/files/files/ditarunonifika.pdfIn PDF document text
    • https://tiguan-wiki.ru/file/xesejorerexaluxet.pdfIn PDF document text
    • http://alexforstarlight.com/clients/4/41/4125d763bdae894b2c088b8c4c0f4705/File/bibekotixaguxekuwipinube.pdfIn PDF document text
    • http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160947d24e1d09---rofeperupuwarawipamekewi.pdfIn PDF document text
    • http://compie.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160b265c89ed88---60985144960.pdfIn PDF document text
    • http://doverhighschoolhalloffame.com/clients/2/2d/2d76883e1086210ef8e2c43836b0327f/File/resobomaruvogeluka.pdfIn PDF document text
    • http://faxik.ru/ckfinder/userfiles/files/negisosuf.pdfIn PDF document text
    • https://travelselection.us/wp-content/plugins/formcraft/file-upload/server/content/files/1606e85307afdc---9436612163.pdfIn PDF document text
    • http://ckpak.com/fckeditor/userfiles/file/gokiwitosasuzegano.pdfIn PDF document text
    • https://www.mixedclass.com.au/wp-content/plugins/super-forms/uploads/php/files/m5qgq1thl59gued31qlrpka397/xigaremadidi.pdfIn PDF document text
    • https://myphambambi.com/webroot/img/files/14752842101.pdfIn PDF document text
    • http://www.adanakursmerkezi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e9f11d4ccc---6388122489.pdfIn PDF document text
    • http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d321f56177---41583738328.pdfIn PDF document text
    • https://mobiligennari.com/userfiles/file/32033596111.pdfIn PDF document text
    • https://ncfouting.com/wp-content/plugins/formcraft/file-upload/server/content/files/160704a9ef06b2---sidusek.pdfIn PDF document text
    • http://maychamsocda.vn/images/userfiles/file/48395005102.pdfIn PDF document text
    • http://www.finanzanlagen-honorarberatung.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607b8f5e740b1---lopefofubadudekisotawegos.pdfIn PDF document text
    • http://imreelectric.sk/uploads/file/lefetuderujuraj.pdfIn PDF document text
    • https://wavesmaroochydore.com/wp-content/plugins/super-forms/uploads/php/files/6veu20cdpqorgcjmlffesadseu/xamasovi.pdfIn PDF document text
    • http://angeladaniel.eu/uploads/files/16896440079.pdfIn PDF document text
    • https://www.wflorlando.com/wp-content/plugins/super-forms/uploads/php/files/43b125111e102c25c35ead95ca7f2a08/81370407022.pdfIn PDF document text
    • https://briljant-maleri.se/UserFiles/files/wogajaloxijaxo.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=silent+letter+spelling+rulesPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f889.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF889 17380 bytes
SHA-256: 36d75803711b0b509aa8044199f2e20dee4c3d41ee43243fafb07fb241edcc05
font_01_sfnt_off000125a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125A1 10320 bytes
SHA-256: 82ba067a82e2f9dca9a6eeab996532f61e9828bf3a8e04f3b8671016b41daed7
font_02_sfnt_off00013cf8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13CF8 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.