Malicious PDF — malware analysis report

Static analysis result for SHA-256 36f4026d805b8b7f…

MALICIOUS

PDF

86.4 KB Created: 2021-07-05 04:57:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 32a534c7134206f804ecfc8c11e84e36 SHA-1: 6dedd1738b88926870cbd4ecc514a679ab0f6a96 SHA-256: 36f4026d805b8b7f13d18521946f654778c2194f8d09536cea543b47add3b7e7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The ML classifier and ClamAV detection strongly indicate maliciousness. The PDF contains numerous links to compromised WordPress sites and disposable hosting, suggesting a link farm used to redirect users to malicious content. The presence of external URIs and link farms points towards a phishing or malware distribution campaign, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9947

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://meruzhankhachatryan.com/app/webroot/files/file/70217273256.pdf In PDF document text
    • http://www.naturapreserved.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607037ff1088d---telezufagilig.pdfIn PDF document text
    • https://ntct.dz/ckfinder/userfiles/files/jevafav.pdfIn PDF document text
    • http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d2b1260ae55---33433311570.pdfIn PDF document text
    • https://www.couleurs-et-jardin.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160726f4c5508e---82422778580.pdfIn PDF document text
    • https://ketgate.eu/wp-content/plugins/super-forms/uploads/php/files/3ff9438d21f08cc8e0bc1dbd717d7b72/topatu.pdfIn PDF document text
    • https://jetzterstrecht.hamburg/wp-content/plugins/super-forms/uploads/php/files/cnrspoicf2t9gh75vdl1chetbr/54627044719.pdfIn PDF document text
    • https://www.sussexweddingservices.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1608104bc905ba---wigomaneze.pdfIn PDF document text
    • http://zafirkort.com/uploads/files/bukuwariwozutaxeronuvaw.pdfIn PDF document text
    • https://www.golddustdental.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b8338492864---mimikanosuxojudiwuzulere.pdfIn PDF document text
    • http://www.segurosfacility.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b3e42d7c397---9785627089.pdfIn PDF document text
    • https://trichynext.com/wp-content/plugins/super-forms/uploads/php/files/3915caf002c4317fa29bb6e3d04a04c9/kezuzaluzonot.pdfIn PDF document text
    • http://blpest.com/UserFiles/file/sejisuwilafaviduza.pdfIn PDF document text
    • https://tcufroghouses.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f63eed86e7---renibejewuzejozab.pdfIn PDF document text
    • https://ccveg.org/wp-content/plugins/super-forms/uploads/php/files/dk82isf0i3hc7t52qls2tm3864/21463498681.pdfIn PDF document text
    • https://metroguards.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1606f0bafaa127---medadevizixidanugema.pdfIn PDF document text
    • https://t2sc.me/userfiles/sipojibeg.pdfIn PDF document text
    • https://inchirierielicopter.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609e21d4eb79a---tomezivij.pdfIn PDF document text
    • https://cspdental.com/wp-content/plugins/super-forms/uploads/php/files/95561247af5a8b0a5bfdabd37ffafc08/sezoban.pdfIn PDF document text
    • http://sungsam.net/userData/board/file/97502773179.pdfIn PDF document text
    • https://alakharia.com/public_html/userfiles/file/8658786323.pdfIn PDF document text
    • http://iwilldoit.ru/uploads/files/files/sivinotuwirenipubipajebep.pdfIn PDF document text
    • http://phatnang.com/media/ftp/file/naguwilaxepad.pdfIn PDF document text
    • http://anthonyvienna.com/sites/default/files/file/basinesod.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/6naE_Nh8_CY/uplcv?utm_term=amlodipine+and+peripheral+edemaPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE1A 10372 bytes
SHA-256: 1dec499ff845e5103fdd9778c6d6c3b4a7a5135520e2835c9718c35d7c2f83b1
font_01_sfnt_off00010535.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10535 18108 bytes
SHA-256: d9dab0ca4465b24190577efa85bad2f33af0cdbc2ac2464302ac0f0c896aecd2
font_02_sfnt_off000133f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x133F8 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.