Malicious PDF — malware analysis report

Static analysis result for SHA-256 32c33f49a7f1114a…

MALICIOUS

PDF

88.0 KB Created: 2021-06-18 06:58:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: edd53258ea1530c1fe48df1223c35064 SHA-1: bca22ec15af949830a47d815cefab61a77274672 SHA-256: 32c33f49a7f1114a0252ac40d3c0cdefe36d977c07c6d1b206b48c26b87b28da
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm, many hosted on compromised CMS upload directories. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cb1d6be8f96---66656816019.pdf In PDF document text
    • https://advancedbusiness.co/wp-content/plugins/super-forms/uploads/php/files/08db98c0ecc95f3c3add097dec44f0ed/rutugulugipotajigiwot.pdfIn PDF document text
    • http://nuitsdartistes.eu/images/file/zanevaloxepokejopubo.pdfIn PDF document text
    • https://muzeumkonstancina.pl/attachments/file/tuvedapuxiduxegiku.pdfIn PDF document text
    • https://www.cir.cloud/wp-content/plugins/formcraft/file-upload/server/content/files/160b3032be346c---tepebevok.pdfIn PDF document text
    • https://hmv.ir/wp-content/plugins/formcraft/file-upload/server/content/files/16080c846dbccd---vaxukuzole.pdfIn PDF document text
    • https://myupfield.link/wp-content/plugins/super-forms/uploads/php/files/ki1h7rdqc68shnlo2n1t7j1vje/wofazovitisigub.pdfIn PDF document text
    • http://sskj.pl/userfiles/file/gakexigax.pdfIn PDF document text
    • https://xn--1--8kcai1ck2bs.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/8fd9229d028537bc5fdf8c037b470407/liwolofi.pdfIn PDF document text
    • http://lukoilmarine.com/ckfinder/userfiles/files/givigopozupijab.pdfIn PDF document text
    • https://aartipalette.com/userfiles/file/bozasapigo.pdfIn PDF document text
    • http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a7f954c1795---sarozini.pdfIn PDF document text
    • https://alternativecarrepair.com/userfiles/file/33288617453.pdfIn PDF document text
    • http://xn--80akij1ajew.xn--p1ai/wp-content/plugins/formcraft/file-upload/server/content/files/1609174931f918---84744625325.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=rab+ne+bana+di+jodi+mp3+pagalworldPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00011572.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11572 18008 bytes
SHA-256: 822de35188eafd4193d0b231d9d1886d70feb8fdfe5e7f6fdbb186780e9e8bc7
font_00_sfnt_off0000cdfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCDFD 5288 bytes
SHA-256: 9dd6fd04c0941fe58e49dc3caa69c862f31bfd6d43d01d16fdd358062bccf614
font_01_sfnt_off0000dfd8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFD8 5016 bytes
SHA-256: 94da07559146c9c6fe30e9e19f30da215f89cdc534477634c431c64068fa44c2
font_02_sfnt_off0000ed72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED72 11908 bytes
SHA-256: 19e3b1a7b90abb2cd79c2ba16ec60ebdb63ca6fce48ed1040f67f5e72f4edee8
font_04_sfnt_off0001312e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1312E 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34
font_05_sfnt_off00013f2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F2F 4860 bytes
SHA-256: 8ab24089c65f609618a999cd4e40e71162c34c121f6fa9d5a3d1f0d566fe46fe

Open this report in the interactive analyzer, or submit your own file for analysis.