Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e6c2d6bf531cd8a…

MALICIOUS

PDF

84.7 KB Created: 2021-07-06 02:23:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: fd1e51d67b7cd7a851a7a9f1924c1cc8 SHA-1: e596cc34f285c74872ced6633c5e1199c043b1df SHA-256: 2e6c2d6bf531cd8a3dd88bada2fa9c9a6fd2139174595e4cd775b3854659a3dd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by a machine learning classifier and ClamAV as malicious. It contains numerous links, many pointing to compromised WordPress upload directories, suggesting a link farm designed to distribute malicious content. The presence of embedded URLs and the nature of the link farm indicate a phishing or malware distribution attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://maxkbm.com/clients/2/28/28fcaa936e2ecbeb6c9a97ea0f1ab253/File/10426359863.pdf In PDF document text
    • http://cambresisemploi.fr/ckfinder/userfiles/files/30669318569.pdfIn PDF document text
    • http://vytvarnyobchod.cz/UserFiles/File/20100310040.pdfIn PDF document text
    • https://aryaayur.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3d5044b64d---5189295023.pdfIn PDF document text
    • https://www.rydalmereprestige.com.au/wp-content/plugins/super-forms/uploads/php/files/2fk1urmvocmkmtc1fm8t7s0tl1/tudotidejodatoviwadav.pdfIn PDF document text
    • http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16091a9d962ef1---50881570836.pdfIn PDF document text
    • http://es-manzokudou.com/yamituki-n/uploads/files/56505414647.pdfIn PDF document text
    • http://aelma.com/sites/default/userfiles/file/73923748303.pdfIn PDF document text
    • https://vuaship.com/wp-content/plugins/super-forms/uploads/php/files/sfmaae06jgpvgfpoh06c0q8lr1/sitofesagavafe.pdfIn PDF document text
    • https://vdbergelectro.nl/wp-content/plugins/super-forms/uploads/php/files/0e233d445f344661d95705c405439329/fefovavubovolib.pdfIn PDF document text
    • http://discoveryenglish.org/wp-content/plugins/formcraft/file-upload/server/content/files/160d9250a0747b---27046280020.pdfIn PDF document text
    • http://anhuizhkj.com/upload_fck/file/2021-5-8/20210508173529623342.pdfIn PDF document text
    • https://alkhairi.co.uk/wp-content/plugins/super-forms/uploads/php/files/5c136583188c4b6e2daa6e576fe00314/43134396854.pdfIn PDF document text
    • http://terapie-psi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16083feb1776b4---86694359339.pdfIn PDF document text
    • http://ebbers-schilderwerken.nl/uploads/files/29270956962.pdfIn PDF document text
    • https://torrentclub.vip/wp-content/plugins/super-forms/uploads/php/files/kjb8j3kfjcivak5jp0lf8o9fgm/zeponali.pdfIn PDF document text
    • http://dijladentalcenter-qa.com/userfiles/file/lonemufozewikotujaposili.pdfIn PDF document text
    • http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/4ovfs3lf12j70cr6jcvq4k1vh3/25781296271.pdfIn PDF document text
    • http://ajivikafinance.com/userfiles/file/fodiwibubelan.pdfIn PDF document text
    • http://stroisvias.ru/userfiles/file/49326229088.pdfIn PDF document text
    • http://www.suffaheducation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607177bb1f596---47187493997.pdfIn PDF document text
    • http://pronobile.de/catalog/file/soposafelasaxafutuzuwut.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=terence+crawford+next+fightPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8F6 10692 bytes
SHA-256: eec117f7d2919d0c5813fa38e357f03c84d4002ecf65c2207e611d29e676ea7f
font_01_sfnt_off00010149.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10149 16992 bytes
SHA-256: ab10576b94863ede61ef5eccb285a6a2a81777a016d6ee6317e4b45f9c3aa76c
font_02_sfnt_off00012d95.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D95 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.