Malicious PDF — malware analysis report

Static analysis result for SHA-256 36445d73d837be6f…

MALICIOUS

PDF

88.8 KB Created: 2021-08-06 17:53:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 07790f88a3edda06c076c5170c029dbf SHA-1: e8a4ba58aa342ae1d88f09cd30dd8d0a6d53e35d SHA-256: 36445d73d837be6feca5f3d07f9ac924c0eadde3ede457a6cfa3113ec9772716
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous embedded URLs pointing to compromised WordPress sites and potentially disposable hosting. The primary goal appears to be directing users to external, possibly malicious, content, which is a common tactic for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9877

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ewms.vn/wp-content/plugins/super-forms/uploads/php/files/ot8311l6q93cqhpm4m2491dash/josogagufegukonakutevirun.pdf In PDF document text
    • https://athensviptour.com/wp-content/plugins/super-forms/uploads/php/files/88b41b9b3d5e37b1b3c7492e2ed1704c/7000400536.pdfIn PDF document text
    • https://renetravel.ro/images/files/nesotibadenunod.pdfIn PDF document text
    • http://afghansolar.com/userfiles/file/wegenazakik.pdfIn PDF document text
    • https://www.lumisolar.pe/wp-content/plugins/formcraft/file-upload/server/content/files/160850f8b79d2e---talomopesem.pdfIn PDF document text
    • https://annjulieskarpmo.com/userfiles/file/17793484347.pdfIn PDF document text
    • https://searchlink.org/userfiles//file/pirijoxubi.pdfIn PDF document text
    • https://studio45.live/wp-content/plugins/super-forms/uploads/php/files/b4rpvr1ibc105tc6b8cqllc6fv/31154439629.pdfIn PDF document text
    • http://vidol.nl/userfiles/file/78657065097.pdfIn PDF document text
    • https://priscar.com/documents/files/70402225000.pdfIn PDF document text
    • http://euroteam.vn/ckfinder/userfiles//files/kewezasoworaguz.pdfIn PDF document text
    • http://saokienviet.com/uploads/image/files/rorimevopemedopureledar.pdfIn PDF document text
    • https://djennebeads.com/nbloom/fckuploads/file/kupimafas.pdfIn PDF document text
    • http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160768d6920bd7---zuxalaxigoz.pdfIn PDF document text
    • http://stpatricksreunion.com/clients/84553/File/levumixopowatomevaniwevow.pdfIn PDF document text
    • https://webtraffic.ch/wp-content/plugins/super-forms/uploads/php/files/av162kd9fmqmfico1ucr0r56bs/bedevepelagekeva.pdfIn PDF document text
    • https://castilloexterior.net/ckfinder/userfiles/files/motivagosebaxot.pdfIn PDF document text
    • https://kogan-photo.ru/wp-content/plugins/super-forms/uploads/php/files/3941a3b9bf25930685fc641d3b853c6e/5689788679.pdfIn PDF document text
    • https://arenda1s.ru/wp-content/plugins/super-forms/uploads/php/files/11ffd9b0db9557f0054d167c42fd390f/37940881201.pdfIn PDF document text
    • https://www.kadeavenue.com/wp-content/plugins/super-forms/uploads/php/files/a17cd79f070fac82267304d23ce287cc/50147320817.pdfIn PDF document text
    • https://lsp.od.ua/wp-content/plugins/super-forms/uploads/php/files/9dtt1j7fue80v04rsjb8venv51/tabexexaraguvunu.pdfIn PDF document text
    • https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609eaa309a181---79422047119.pdfIn PDF document text
    • http://timatey.kz/wp-content/plugins/super-forms/uploads/php/files/9fbndisg9hkq3skvl8rr8qi4j1/mabuwifudodujowigapux.pdfIn PDF document text
    • http://ezstreetautosales.com/clients/876244/File/fazajimuvega.pdfIn PDF document text
    • http://apsencollege.org/test/fckeditor/file/22826308433.pdfIn PDF document text
    • http://mesahighclassof63.com/clients/79820/File/lusasuvitudimusedepez.pdfIn PDF document text
    • http://kazenergy.kz/wp-content/plugins/formcraft/file-upload/server/content/files/1608e08edd2cfe---kibalunavejar.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/6naE_Nh8_CY/uplcv?utm_term=price+to+install+drywall+per+sheetPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f934.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF934 10812 bytes
SHA-256: 2a8510e1c99709bc13e046a109afb04511b0dd2972bc019d843d87f4f0b6090a
font_01_sfnt_off00011225.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11225 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00012a37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12A37 16176 bytes
SHA-256: 25ccd607cd1c73ce1e9d90524381d1635176e5c0991676ee592f2de18a8cc25b

Open this report in the interactive analyzer, or submit your own file for analysis.