Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ea61ea909c2caeb…

MALICIOUS

PDF

99.2 KB Created: 2021-08-08 17:57:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 9ebc3becf1fbb26096ca99ef5db4c9b9 SHA-1: 828f557ef67c1b112adf93e258d9b0a1ded55f3b SHA-256: 2ea61ea909c2caeb1c583496e7c6e9b8e70546c8b87eec0f1b9f5a9573fb7f90
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous external links, many pointing to compromised WordPress sites or disposable hosting, suggesting a link farm designed to redirect users to malicious content. The presence of these links and the overall detection indicate an attempt to exploit users through deceptive redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/uplcv?utm_term=how+do+i+get+a+pound+sign+on+my+ipad+keyboard PDF link annotation
    • http://kmkonsult.cz/userfiles/file/75179467405.pdfIn PDF document text
    • http://stkvn.ru/wp-content/plugins/super-forms/uploads/php/files/4868fba5624ebd24a4c2e3c998f50790/vofabogufelafolewijax.pdfIn PDF document text
    • http://wabasnb.com/files/fckeditor/file/174968148160a8e10b94d17.pdfIn PDF document text
    • http://hilltopperalumni.com/clients/9/93/936f23dc4abb03f6d4a1aae2c8a32781/File/vizuzewop.pdfIn PDF document text
    • https://cepatdaftargroup2.com/contents//files/80182439906.pdfIn PDF document text
    • https://olivierdaulte.com/ckfinder/userfiles/files/36245764226.pdfIn PDF document text
    • http://thehawthornnyc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607801c6f3ab2---33683909176.pdfIn PDF document text
    • https://plumcourse.com/wp-content/plugins/super-forms/uploads/php/files/352e4b5b09fb5fa3e5cc3605b4c6805e/94482871227.pdfIn PDF document text
    • http://konsultacjenaukowe.eu/Upload/file/jaliwubibijenixisapovujef.pdfIn PDF document text
    • https://www.varishastalari.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070cb8c1b88c---37200638712.pdfIn PDF document text
    • http://cottoneauto.it/userfiles/files/dovanolaloxoromukolujeken.pdfIn PDF document text
    • http://recruiters-zone.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cda12771b31---wigajotajazogozunosakuge.pdfIn PDF document text
    • https://www.alignerco.ca/wp-content/plugins/super-forms/uploads/php/files/e3c8747c88f837d2bf631ff2d18cae3a/66729276562.pdfIn PDF document text
    • http://www.sempresaude.net/wp-content/plugins/formcraft/file-upload/server/content/files/160911a1920c06---mukuxebateb.pdfIn PDF document text
    • http://unesco-mediain.cz/fckfiles/file/78129326109.pdfIn PDF document text
    • http://kirks-pool.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e10bb7047cc---ninivopejiva.pdfIn PDF document text
    • https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/8044f3d80c43605a10beb98d87f401f2/54053540838.pdfIn PDF document text
    • http://www.homefacelifters.com/wp-content/plugins/super-forms/uploads/php/files/1b3dd22f1143c566fd1acfdc93a84cac/lupazite.pdfIn PDF document text
    • http://rothemtour.com/FileData/ckfinder/files/20210807_22B0188DD345FE36.pdfIn PDF document text
    • https://ntwbearing.com/UserFiles/File/motojelekipazemepam.pdfIn PDF document text
    • http://www.pilonidalsinus.gen.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1607117d4f0e8e---wilisokokavevixoz.pdfIn PDF document text
    • http://theopenhouseclub.com/wp-content/plugins/super-forms/uploads/php/files/98e61eacabea119e2d5fe046eb837e58/safunaxel.pdfIn PDF document text
    • http://spoanalyze.com/wp-content/plugins/super-forms/uploads/php/files/163ea9509d73617a099d009a3bfac89d/23785178612.pdfIn PDF document text
    • http://stkvn.ru/wp-content/plugins/super-forms/uploads/php/files/0e62afeca44c22bd8c847fd4f967b9f0/77753599287.pdfIn PDF document text
    • http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607d2ac456822---zopiput.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB45 11212 bytes
SHA-256: a3a7527d176c5085393d1b0d2a05b24bff877e22b31d6b2cb9b6babc740aa215
font_01_sfnt_off00011521.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11521 20948 bytes
SHA-256: 338e36466b6175dfe0a254b69d008428d5b3f7e3784d4c37eacd3e44f1cf16f1
font_02_sfnt_off00014d55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14D55 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00016566.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16566 16856 bytes
SHA-256: 46f61bb9a099a338dcc26d702888e7a6b3faa5a87869c0dc597b010155a97e54

Open this report in the interactive analyzer, or submit your own file for analysis.