Malicious PDF — malware analysis report

Static analysis result for SHA-256 293f8347a54385c9…

MALICIOUS

PDF

91.2 KB Created: 2021-08-08 06:42:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-31
MD5: 65a6671307ba0d8f045f93b4ef50dc07 SHA-1: 692183e910aca1340ab2ab2bfb452c81b8e2fdc7 SHA-256: 293f8347a54385c9d12e7aca26e872fd70f0f4d2a4c45a66ab54743e9090c8aa
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as a malicious PDF by ClamAV and a machine learning classifier. It contains embedded JavaScript and numerous external URIs, many of which point to compromised or disposable hosting, suggesting a phishing or malware distribution scheme. The embedded JavaScript likely facilitates the redirection to these malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pistant.ru/uplcv?utm_term=les+ensembles+et+les+applications+exercices+corrig%C3%A9s+pdf PDF link annotation
    • http://nassagroup.org/app/webroot/js/ckfinder/userfiles/files/kubipexamagawizise.pdfIn PDF document text
    • https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160849deaa82aa---96153708586.pdfIn PDF document text
    • http://www.dj-csnl.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607adee4db751---poruvux.pdfIn PDF document text
    • http://emeat.ru/var/files/kuvujonudumumu.pdfIn PDF document text
    • https://istanajpdua.com/contents//files/86664355900.pdfIn PDF document text
    • https://simovi.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1609703bd6b584---16736156102.pdfIn PDF document text
    • http://camionespanamericana.com/userfiles/file/jufudipu.pdfIn PDF document text
    • http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160bc8834f259f---tavelozeforaweju.pdfIn PDF document text
    • https://www.elektrobetrieb-scholz.de/wp-content/plugins/formcraft/file-upload/server/content/files/16074262ccf445---94253683967.pdfIn PDF document text
    • http://joy05.com/_UploadFile/Images/file/jutiwiped.pdfIn PDF document text
    • http://manufim.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/1606fddf422aa7---73209627340.pdfIn PDF document text
    • https://forex-robo.org/wp-content/plugins/super-forms/uploads/php/files/d82e1626715692767a3b404231f179d4/lesovud.pdfIn PDF document text
    • http://albatrossmrn.com/konadnew/userfiles/file/josiweku.pdfIn PDF document text
    • https://rhagro.com.mx/wp-content/plugins/super-forms/uploads/php/files/83c3a23d82c3dcc3386dc891ec7d9d77/61102245807.pdfIn PDF document text
    • http://princeworldwide.com/multimedia/userfiles/file/77705305048.pdfIn PDF document text
    • http://ausafe.net/images/art/files/83851487132.pdfIn PDF document text
    • http://takeacode.net/user/d41d8cd98f00b204e9800998ecf8427e/file/xikolaz.pdfIn PDF document text
    • http://fontanarosaserigrafia.it/userfiles/file/xexinovufesujogidenexudi.pdfIn PDF document text
    • https://primewestelectrical.com/wp-content/plugins/super-forms/uploads/php/files/c165906006c93731a04df86458e1d4f5/vunememafijigojerunen.pdfIn PDF document text
    • http://jointrilogy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc075c5cd3---16987820825.pdfIn PDF document text
    • http://falerisztika.hu/tmp/feberajalezebuzizugif.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea17.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA17 11316 bytes
SHA-256: 8c35f7b55b95a34fa47df1f3a1dc12a1578ee6139b4ee15e98db94a15edb3cf7
font_01_sfnt_off000103f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103F8 16744 bytes
SHA-256: 0385899629a0c141a2c3dd726fb1775fa023b88b17a004a9b03d1364e1e37cc6
font_02_sfnt_off00012d5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D5F 16204 bytes
SHA-256: 2f37ea1b11ece644fef2f420fc5d5e29c860255d372ec3a711666e2589675489
font_03_sfnt_off00014311.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14311 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.