Malicious PDF — malware analysis report

Static analysis result for SHA-256 26db643c3bcb0341…

MALICIOUS

PDF

83.3 KB Created: 2021-07-18 00:01:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: f925e0bcd2870b2f6d8eb17119f4d8b2 SHA-1: d0d06d7b12622ee646c2e81ad71f11d26c36728b SHA-256: 26db643c3bcb03414a85df963658e2b7b6a3262813e55810383da6c690bcbf79
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by ClamAV as Pdf.Phishing.Trojan and an ML classifier indicated a high probability of maliciousness. It contains numerous embedded URLs, many of which point to compromised CMS upload directories or are part of a link farm on disposable hosting, suggesting an attempt to obscure the final destination. The presence of these link farms and the overall structure indicate a likely phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/6162c740cbd60e5261681135f7195c2e/61966831625.pdf In PDF document text
    • http://eugensa.lt/app/webroot/uploads/userfiles/files/22237117233.pdfIn PDF document text
    • https://clubsecurite.fr/webroot/upload/files/34628062081.pdfIn PDF document text
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160e4b6a85f5a9---tupujuruwaruriwe.pdfIn PDF document text
    • https://comodee.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a18643ab53---fodajekosowig.pdfIn PDF document text
    • http://clarksville.net/wysiwygfiles/file/41285655000.pdfIn PDF document text
    • https://f1com.ge/wp-content/plugins/super-forms/uploads/php/files/4e82c0669549a91d6637d97e3801efcb/lujamobozitawerat.pdfIn PDF document text
    • http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16074bf8d7b7b7---kegusaburagufeto.pdfIn PDF document text
    • http://littlepearlbooks.in/data/eimages/file/jejovida.pdfIn PDF document text
    • https://borderpak.com/wp-content/plugins/super-forms/uploads/php/files/fbaa67d4c8fd7e9efb9844d5fd291079/binobatupafobogu.pdfIn PDF document text
    • https://ceilford.org/wp-content/plugins/super-forms/uploads/php/files/e2dbaff7f042da3490b302dc94d68713/13099588886.pdfIn PDF document text
    • https://viettrungson.com/media//Files/89781327910.pdfIn PDF document text
    • https://canadiancontractorservices.com/wp-content/plugins/super-forms/uploads/php/files/n8t97hmq9qtd757v8d12pok251/39060105328.pdfIn PDF document text
    • http://www.kilincsweb.hu/fileok/file/49104119369.pdfIn PDF document text
    • http://sacoorhealth.pt/site/upload/file/gepavipovabadelokepi.pdfIn PDF document text
    • https://www.isnb.co.uk/wp-content/plugins/super-forms/uploads/php/files/45d63d731e01bb2781a7774b0eea38fb/88288101250.pdfIn PDF document text
    • http://tamilannuaire.com/var/www/vhosts/vps296430.ovh.net/tamilannuaire.com/images/file/51718099671.pdfIn PDF document text
    • http://amctop.com/board_data/editor_img/file/202105101001.pdfIn PDF document text
    • http://www.nisbd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bbb96d8b9cc---ditoposesowosaxelivudole.pdfIn PDF document text
    • https://www.novet.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607baf9e4b8a6---famow.pdfIn PDF document text
    • http://onishi-kyosendo.jp/archive/povelafame.pdfIn PDF document text
    • http://www.morenoroofing.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606e6252af2e5---jigakusoxejejeman.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=chevy+2500+owners+manualPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1E8 10956 bytes
SHA-256: 754a1e21a9831797100c2287d29fb49450d8f96a40d6b6cccf002940bf60ed62
font_01_sfnt_off0000fb55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB55 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00011367.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11367 17272 bytes
SHA-256: da1786afdf3914fdcc8d1d713384d8da427b4bf9a699371a96bf7da06a7447ee

Open this report in the interactive analyzer, or submit your own file for analysis.