Malicious PDF — malware analysis report

Static analysis result for SHA-256 2235f1b65f1a2f39…

MALICIOUS

PDF

155.6 KB Created: 2021-06-09 21:51:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 236e66248ebc85c981e2d4246daeff65 SHA-1: 64619a2b020160b0ddbdf4bff8e229732e990a17 SHA-256: 2235f1b65f1a2f39cbf61afdb8c6ecb68ac08f471bad7aa022bfcd21ae78136f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document contains numerous links to external websites, many hosted on compromised CMS platforms, suggesting a phishing or malware distribution campaign. The presence of PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates a link farm strategy, likely to obscure the true destination or to leverage SEO for malicious purposes. The document body, though heavily obfuscated, contains keywords related to 'Christmas images jesus birth', suggesting a lure to disguise the malicious nature of the links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=christmas+images+jesus+birth PDF link annotation
    • http://www.motorradfreunde-toggenburg.ch/up/files/bapivowe.pdfIn PDF document text
    • https://monuments-msk.ru/wp-content/plugins/super-forms/uploads/php/files/00f84a6a353b403a2b5282172c5849ef/69613480452.pdfIn PDF document text
    • http://monktonlionsclubkidscamp.com/clients/9/99/99b8b5517e5fb663501b7ee5137ebf55/File/50722904260.pdfIn PDF document text
    • https://elicopter-de-inchiriat.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609a98d93eabb---lijitonevudu.pdfIn PDF document text
    • https://carpanea.it/wp-content/plugins/super-forms/uploads/php/files/9dc9146e986fb94e8c1ae813fd18ed87/nagadekasifadud.pdfIn PDF document text
    • http://grandinhr.eu/images/user/file/fixurowilunupuj.pdfIn PDF document text
    • http://countrysquirefoods.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607400422ea5c---22731368769.pdfIn PDF document text
    • http://grandp.ru/userfiles/file/31196954601.pdfIn PDF document text
    • https://www.ideaklinikankara.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070785b5e70c---masera.pdfIn PDF document text
    • https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608de5f9817a4---meremoxatugarif.pdfIn PDF document text
    • http://lichnyiybrand.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607347263c60e---lumopikos.pdfIn PDF document text
    • http://ophtalmic-overnight.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1608a7cce10299---sizanogutikifokulomenu.pdfIn PDF document text
    • http://szpital-sulecin.pl/images/fckfiles/file/xuliko.pdfIn PDF document text
    • http://ahkjt.com/upfile/file/nutirazisu.pdfIn PDF document text
    • http://ergo-logo-bamberg.de/userfiles/file/81701563254.pdfIn PDF document text
    • https://yingzhaoliuart.com/upload/file/36845753614.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002047d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2047D 5188 bytes
SHA-256: 56bd85d14c0015d88a495aed31fc85d6fe915d5e55b64a0fe41184abb72f9203
font_01_sfnt_off000215f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x215F3 14420 bytes
SHA-256: ee904b586dfca11c4bdf5ef01cd1fbe4ac8deb05f97d030084d5811fb16ef2ce
font_02_sfnt_off000242f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x242F7 19072 bytes
SHA-256: 63df0f8d770e2f46aa15923147b48428135abd3f2374446fbc5c0bddfab03615

Open this report in the interactive analyzer, or submit your own file for analysis.