Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b72b9905063fed8…

MALICIOUS

PDF

87.5 KB Created: 2021-06-26 17:01:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: 950b5c075d17225921110ba78da4f9d1 SHA-1: e789feb62bfffc874c1da7688fc69a955562581d SHA-256: 2b72b9905063fed8455ca463bd56fc689e618959311dcb1e99af1bcd759de8ca
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains numerous links pointing to other PDF files hosted on compromised websites, indicating a phishing or malware distribution attempt. The presence of PDF_RANDOM_URL_LINK and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics strongly suggests malicious intent. While no scripts were extracted, the structure and URL patterns are consistent with a phishing campaign designed to lead users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ildungrice.com/fileupload/fckeditor/file/zofomubugowomukamavek.pdf In PDF document text
    • http://www.urbanwaterways.info/files/72038360593.pdfIn PDF document text
    • http://www.dnevi-sekretarjev.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16091911249009---dovurexi.pdfIn PDF document text
    • https://privatecambodiatour.com/userfiles/file/83223333419.pdfIn PDF document text
    • http://host.keraladreamhomes.com/~viswabrahmathach/admin/fckeditor/editor/filemanager/connectors/php/userfiles/file/ligebigojizejufigaxu.pdfIn PDF document text
    • http://developmentassociationofnagaland.org/nbloom/fckuploads/file/tawunidarexasudezagugin.pdfIn PDF document text
    • https://ecef-groupe.com/wp-content/plugins/super-forms/uploads/php/files/g8g3ii50tl0pea3rvu4es6bg45/42051343210.pdfIn PDF document text
    • https://lisacutler.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075d5e478c62---77846696383.pdfIn PDF document text
    • https://www.olympusnorge.no/wp-content/plugins/super-forms/uploads/php/files/440mc6svupo1aaq0sk192taahc/85669373371.pdfIn PDF document text
    • https://trichynext.com/wp-content/plugins/super-forms/uploads/php/files/9fc07aae12ec2fcd2cf6ae564bf80ab1/48403640142.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084af59d692f---midovanozajuxaxaduge.pdfIn PDF document text
    • http://zrdb-drogbud.pl/Upload/file/dorufevufebiliwinevudu.pdfIn PDF document text
    • https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/ccd3a53443c93f023cf2d4ab8e133809/31145483138.pdfIn PDF document text
    • http://brothersaluminium.com.np/wp-content/plugins/formcraft/file-upload/server/content/files/160875f77cbf77---2094041219.pdfIn PDF document text
    • https://www.coconutlodge.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a5f9f900f8d---67118665093.pdfIn PDF document text
    • https://rumputhijau.com/contents//files/sumokijixebimekaxu.pdfIn PDF document text
    • https://www.eziblank.com/wp-content/plugins/super-forms/uploads/php/files/5mtuvdej3rj2jou94koob2nvs4/roridotuwujini.pdfIn PDF document text
    • http://chinoboxingclub.com/clients/36032/File/farumixobuderos.pdfIn PDF document text
    • https://thewentworthco.com/wp-content/plugins/super-forms/uploads/php/files/am3c7hfb7fv4vmhfnn5dmsgf11/woleminape.pdfIn PDF document text
    • http://rufullthrottle.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f289acc8db---zonigidifigidero.pdfIn PDF document text
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/p0c8u77llb7a73jcpt08r41lf1/dekizewamawowija.pdfIn PDF document text
    • http://monktonlionsclubkidscamp.com/clients/9/99/99b8b5517e5fb663501b7ee5137ebf55/File/wefoledatezalulas.pdfIn PDF document text
    • http://for-rent-leuven.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608433c5eccef---xosokebiziduxufiweti.pdfIn PDF document text
    • http://www.highlandmetals.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1606d443a45ebd---xuxerobeguges.pdfIn PDF document text
    • https://www.certificagreen.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8ed19e7e61---tadowoginoramixomerus.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=how+to+stop+armitron+watch+from+beepingPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edfe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDFE 17768 bytes
SHA-256: a00a55bea08e0868777e24ce10219ac25bca6e5319415b31db8b59be7f59ecf4
font_01_sfnt_off00011cfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11CFA 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013511.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13511 11096 bytes
SHA-256: 137c0405da130e5dab2032e0a61ab6d6a1902f88f8a3d11b64028e17ec313811

Open this report in the interactive analyzer, or submit your own file for analysis.