Malicious PDF — malware analysis report

Static analysis result for SHA-256 3500753418a27319…

MALICIOUS

PDF

109.9 KB Created: 2021-07-01 13:55:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 39bec703ee2e4e2fc3eefab512922d78 SHA-1: 844887b06e125ced53f730776997ece3faf06d08 SHA-256: 3500753418a273199b63f2021b79e80ccc644cfee767a18a8938d40a7461f18f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous links pointing to compromised WordPress sites and disposable hosting, indicating a link farm designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a phishing or trojan distribution intent. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to exploit users via web redirection.

Machine Learning

  • Nyx PDF Classifier clean score 0.2034

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/uplcv?utm_term=castle+tamil+meaning PDF link annotation
    • http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160768c496216c---saropavusatimomotiful.pdfIn PDF document text
    • https://estidevelopers.com/wp-content/plugins/super-forms/uploads/php/files/643678696534a62e41bc71e58506fd16/nolediwefoduleza.pdfIn PDF document text
    • http://biosite.ru/images/news/file/74287124445.pdfIn PDF document text
    • http://singer-island-condos.com/userfiles/files/15639079986.pdfIn PDF document text
    • https://aldurra.ly/images-editeur/img/file/16353090311.pdfIn PDF document text
    • http://intechsol.kz/wp-content/plugins/formcraft/file-upload/server/content/files/160b609e736cbd---71337509011.pdfIn PDF document text
    • https://eobliecky.sk/userfiles/file/betovafelonopevi.pdfIn PDF document text
    • http://terapie-psi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608a91a5e49b5---66059420614.pdfIn PDF document text
    • https://realestateconnect.pro/wp-content/plugins/super-forms/uploads/php/files/njdc2me1fap61op4snksboimr7/vusujokifenomixizaderufu.pdfIn PDF document text
    • https://www.straightmyteeth.eu/wp-content/plugins/super-forms/uploads/php/files/57c3b687e36ffcdbf15914eeacf43285/3203454193.pdfIn PDF document text
    • https://www.conkite.com/wp-content/plugins/super-forms/uploads/php/files/58c48aa380d2fe3bfa32d9c5e00e6851/78558076656.pdfIn PDF document text
    • http://manpukulivermore.com/uploads/files/61657559061.pdfIn PDF document text
    • https://snabavto.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d23fb5b983e---52707485805.pdfIn PDF document text
    • https://wills.sg/wp-content/plugins/super-forms/uploads/php/files/b357c8a6473357cabda8a97e179748f7/parej.pdfIn PDF document text
    • https://www.fecomerciomg.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b41642a09fe---webuwexekilumokisasojifan.pdfIn PDF document text
    • https://yournew.site/wp-content/plugins/super-forms/uploads/php/files/12ac3la86eehu1k900l2et52a1/vozuwi.pdfIn PDF document text
    • https://www.ndgai.com/wp-content/plugins/super-forms/uploads/php/files/j9hvjfe9pbtan3n9johboa1urq/5012271321.pdfIn PDF document text
    • https://www.tctnanotech.com/wp-content/plugins/super-forms/uploads/php/files/a753d6df5035feb6cacdabb7da653cff/gezanigafetofakutavi.pdfIn PDF document text
    • https://manuscripthandler.com/userfiles/file/77863452044.pdfIn PDF document text
    • https://lokmangal.co.in/wp-content/plugins/super-forms/uploads/php/files/29360aeb8e8ca4ce0dacfbefff987451/26302529628.pdfIn PDF document text
    • http://studioboscono.it/userfiles/files/fenuvazivakamupenosomuda.pdfIn PDF document text
    • https://www.endthestigmacounselling.com/wp-content/plugins/super-forms/uploads/php/files/to232t5vkll55cbjgdb0h93me9/32099653846.pdfIn PDF document text
    • https://tfnd.org/wp-content/plugins/super-forms/uploads/php/files/f7e9dd2a980a20dcb51f2f2afe794412/duvepunu.pdfIn PDF document text
    • https://dienlanhhonganh.com/images/pic/file/49219014227.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00013901.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13901 20552 bytes
SHA-256: 6ebbdf3c095900885fd6ef0c50aeb420d15c84ae01c2e4b2ee1115b36d8ff151
font_00_sfnt_off0000fa69.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA69 10264 bytes
SHA-256: 6f720ea52a68f90c42ae582dbd2a0d65c1b2cab3118ec7db2291419b881c43c0
font_01_sfnt_off00011169.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11169 4128 bytes
SHA-256: 065662f8ab239f7de2276556af73f3d11b755417e997b29ea9dc953644bf0311
font_02_sfnt_off000120f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x120F0 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_04_sfnt_off00015d16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15D16 34544 bytes
SHA-256: d9ee8f5af15ca364e270abef5d3565799489c6d12922bd566034e49d1b10904d

Open this report in the interactive analyzer, or submit your own file for analysis.