Malicious PDF — malware analysis report

Static analysis result for SHA-256 387077f41c408821…

MALICIOUS

PDF

86.0 KB Created: 2021-06-30 20:08:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 2a2683eae6ac989551e3a0de02a146cf SHA-1: fb0b68f1c6254d887853eb329a53a62f43da5022 SHA-256: 387077f41c40882158be7bf8bee9a8e4a866dbbb29c9728ee7037fa6c185aa3d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which point to compromised websites or disposable hosting, suggesting a link farm designed to lead users to malicious content. The presence of multiple PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9848

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kopdesign.nl/userfiles/file/tezabijotetix.pdf In PDF document text
    • http://74ahs.com/clients/2/2a/2a132ee8da0778863662fd4b1fa251ed/File/65117016927.pdfIn PDF document text
    • http://www.scmphotography.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160c3f8858f01f---77236807666.pdfIn PDF document text
    • http://extracam.es/app/webroot/arxius/file/bodujanugitagamefileviw.pdfIn PDF document text
    • http://beateromer.com/bilder/file/20962565625.pdfIn PDF document text
    • http://kahounova.cz/userfiles/file/nikumekik.pdfIn PDF document text
    • https://dsodrecital.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ba6d3c2801e---gunewixixifuxuluv.pdfIn PDF document text
    • http://mikomisushiwc.com/uploads/files/wiliwabemewamamopivap.pdfIn PDF document text
    • http://aarogyamedico.com/userfiles/file/84576611253.pdfIn PDF document text
    • http://www.thediethub.in/wp-content/plugins/formcraft/file-upload/server/content/files/1608bfc85cc01e---21437717896.pdfIn PDF document text
    • https://xlux.vn/wp-content/plugins/super-forms/uploads/php/files/qsrni46dhq3ipik6stq5fu7i7i/wutasatoko.pdfIn PDF document text
    • https://www.adelaarenergy.com/wp-content/plugins/super-forms/uploads/php/files/n1bmk0v6rg8le07c5qdemge07q/62006689232.pdfIn PDF document text
    • https://bistakalikotenetwork.com/userfiles/file/97407764207.pdfIn PDF document text
    • http://turexpert.md/userfiles/images/file/jazejipaza.pdfIn PDF document text
    • http://sarlampa.ru/upload_picture/82245370331.pdfIn PDF document text
    • https://alllegaltask.com/wp-content/plugins/super-forms/uploads/php/files/4mdvq9ff47tmgp1r9ohc7t339u/nezajerovifasufawojavujix.pdfIn PDF document text
    • http://generaltubi.com/container/ckfiles/files/9155309523.pdfIn PDF document text
    • http://reiki-roots.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160c36c7c4524d---6473216785.pdfIn PDF document text
    • http://vasilii-orlov.fun/wp-content/plugins/super-forms/uploads/php/files/876183fe2f561cf11b2c52b6087f881a/pavapaf.pdfIn PDF document text
    • http://penzionnakrizankach.cz/ckfinder/userfiles/files/25050547413.pdfIn PDF document text
    • http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c1d5473f048---nufenegedotitolorik.pdfIn PDF document text
    • https://systematix.pl/userfiles/file/domutato.pdfIn PDF document text
    • http://mgmkt.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606c7341b6a41---zetibopuragosela.pdfIn PDF document text
    • http://pebyte.com/wp-content/plugins/super-forms/uploads/php/files/k1ll14c8kpfbl7iscnrpiopgf6/gebinefojodu.pdfIn PDF document text
    • https://aedwea.com/upload/foto/nujebatululonotekaneka.pdfIn PDF document text
    • https://stratasphere.online/userfiles/file/54836100465.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=pagemaker+file+to+pdf+converter+online+freePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecf8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECF8 10952 bytes
SHA-256: 453e6f3c7f5adfc11c6146592ea011c9aaca17f9ab172d295d4ff5950c21b642
font_01_sfnt_off00010620.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10620 16844 bytes
SHA-256: f69431997a71efa13653991fe15adc021270143f5b54556ff5b462b6b425803b
font_02_sfnt_off0001322f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1322F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.