Malicious PDF — malware analysis report

Static analysis result for SHA-256 22a772ec2570666f…

MALICIOUS

PDF

87.8 KB Created: 2021-08-07 00:55:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 2a6bfd0eb2542a3a6f5589817c0e89d0 SHA-1: 3e56a30f6db50801bf6e1ee1dcb8fe458e51e2b7 SHA-256: 22a772ec2570666fb1c0f5ab243d8642c1eb2af08161b82ad6cb1f43c96d2b28
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, presenting numerous URLs that likely lead to phishing sites or further malware downloads. The presence of external URIs and link farm heuristics strongly suggests a malicious purpose, potentially for initial access via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9957

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=imagery+in+macbeth+act+2+scene+4 PDF link annotation
    • https://choiceenergynetwork.com/wp-content/plugins/super-forms/uploads/php/files/8c337deb2da8d9590e6cee7c7796a464/66717583011.pdfIn PDF document text
    • http://global-poseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/16097e25d6dcad---banejaxidisefolagufekit.pdfIn PDF document text
    • https://www.popcaffe.it/wp-content/plugins/super-forms/uploads/php/files/7fc61edcf5c35817d9b6fbd3d6599a75/kavimugemesuk.pdfIn PDF document text
    • http://faurerom.com/userfiles/file/furepeponutipuwer.pdfIn PDF document text
    • http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607971ba69948---powulavuga.pdfIn PDF document text
    • http://adamlegal.com/userfiles/file/48237798834.pdfIn PDF document text
    • http://gibkrakow.pl/uploads/files/41468089314.pdfIn PDF document text
    • http://suriyedostlukdernegi.org/image/files/57156846952.pdfIn PDF document text
    • http://castrolmintabolt.hu/images/upload/file/20413146350.pdfIn PDF document text
    • http://iglozawiercie.pl/zdjecia/file/92467513833.pdfIn PDF document text
    • https://theshairpodcast.com/wp-content/plugins/super-forms/uploads/php/files/e2632775aba964f3ffeff17968e46d3b/refopavorevigowijegi.pdfIn PDF document text
    • http://jhsclassof63.com/clients/c/c8/c8cc7cee7579ddcd469b669c0eb172d8/File/jajubekidiri.pdfIn PDF document text
    • http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/7u9b680cslu04qdk48tmpmat80/zobozawe.pdfIn PDF document text
    • https://signaturetowerpune.com/wp-content/plugins/super-forms/uploads/php/files/644q723h04icnsvl269tm2r987/30581360177.pdfIn PDF document text
    • http://sherwoodonionfestival.com/ckfinder/userfiles/files/nakisade.pdfIn PDF document text
    • http://parfumkin.ru/files/files/76284832381.pdfIn PDF document text
    • https://www.tessilgiada.it/wp-content/plugins/formcraft/file-upload/server/content/files/160aaf59e8700d---94457534738.pdfIn PDF document text
    • http://gsprojekt.eu/userfiles/files/polelixapafenawima.pdfIn PDF document text
    • http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cafde9da127---poribamivufojubuz.pdfIn PDF document text
    • http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/qvufpgo7l3hhfmm366usqlc83q/33382328993.pdfIn PDF document text
    • https://actioncoach.com.my/wp-content/plugins/formcraft/file-upload/server/content/files/1606c6778e2e6b---nalariridixunonu.pdfIn PDF document text
    • http://laduses.nl/image/file/77959099295.pdfIn PDF document text
    • http://visit-pune.com/userfiles/file/67484644568.pdfIn PDF document text
    • https://permargi.com/files/galeria/files/dowixu.pdfIn PDF document text
    • https://mariellatriolo.it/public/file/ralas.pdfIn PDF document text
    • https://tamtam.com.ua/wp-content/plugins/super-forms/uploads/php/files/6fea75f6f6ea698e08d84941bc29da7b/10807192443.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f30c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF30C 10916 bytes
SHA-256: 5cea33b312214db5aef74d070043365d04eee4bee0d12f186711b8a7804b70e5
font_01_sfnt_off00010c37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C37 17116 bytes
SHA-256: bf6f896efafdb7dc2ed8fe10fc4cc799e85ebbe957b1d95b1a6385e5d2ee629a
font_02_sfnt_off000138b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x138B3 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.