Malicious PDF — malware analysis report

Static analysis result for SHA-256 2181379f205cd833…

MALICIOUS

PDF

80.6 KB Created: 2021-06-10 15:17:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: b06b03f10514532d6739fd7894b3ee70 SHA-1: 13d14ecad559d934d1b9a68e52ed55f7ed0a8a6b SHA-256: 2181379f205cd83306ebdf0cd9beb6510ee7f2cbf6ca334f040caca5ad0755c0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document contains numerous external URIs and is structured as a link farm, with many links pointing to compromised WordPress upload directories. These links likely serve as lures to phishing sites or malware downloaders, aligning with a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/uplcv?utm_term=shatta+wale+mansa+musa+ft+vybz+kartel PDF link annotation
    • https://www.traveltimevipp.com/wp-content/plugins/super-forms/uploads/php/files/c61905e6e53407a8f7847d1e36b9a482/gorobogigitipe.pdfIn PDF document text
    • http://az4group.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609bbfce12ef3---dimaxiwef.pdfIn PDF document text
    • https://swotin.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092ecab77415---98590939773.pdfIn PDF document text
    • http://nek.ua/wp-content/plugins/formcraft/file-upload/server/content/files/160a9cf0c3d03a---40495165379.pdfIn PDF document text
    • https://www.chortho.co.uk/wp-content/plugins/super-forms/uploads/php/files/sfcmfcq8quemstor0ue6g2n6vn/menijosugidaredulud.pdfIn PDF document text
    • https://movesforfree.com/wp-content/plugins/super-forms/uploads/php/files/fcj47t13r95c7q5h694gqbt9s5/66993121263.pdfIn PDF document text
    • http://baschin-heizung.com/meineBilderAlbertGrundschule/file/jugesikezudofilidip.pdfIn PDF document text
    • https://damiel.eu/userfiles/file/dixazuvusuxu.pdfIn PDF document text
    • http://dambi.pl/userfiles/file/tavudunawemitawegomul.pdfIn PDF document text
    • http://apexibd.com/uploads/fck_uploads/file/jefugidazun.pdfIn PDF document text
    • https://www.penyembuhanholistikreiki.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609a562201e00---muruzikarelisuni.pdfIn PDF document text
    • https://playgametoday.ru/wp-content/plugins/super-forms/uploads/php/files/ef4fbecd8e1c70bfd352cee67f96c566/91187140705.pdfIn PDF document text
    • http://cn-junsheng.com/upload/file/%5C/202161011090.pdfIn PDF document text
    • https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609af55ce64c0---49598307291.pdfIn PDF document text
    • http://ifa-astrologie.de/userfiles/file/jojeburubododovixezige.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ce22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCE22 5616 bytes
SHA-256: 344b8a5c865fc45e3edcb75dfaf5c184f22a1b492a8564ca87ee06304d7e73ce
font_01_sfnt_off0000e131.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE131 5288 bytes
SHA-256: 3555c3aa77f00b1a9041ae0b5b75df2277579f12d3bb061676c7fe01ef3635bc
font_02_sfnt_off0000f0e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0E4 11172 bytes
SHA-256: 8b682420aeb6b0461678676901d30271b6ae9fedc7b5a90433008954f60a8493
font_03_sfnt_off0001176d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1176D 18596 bytes
SHA-256: 9e5859ea33020fef03fbb6c5b20ad0082121d979bd5902626ac94fd896e5c358

Open this report in the interactive analyzer, or submit your own file for analysis.