Malicious PDF — malware analysis report

Static analysis result for SHA-256 38febfdd27ce9668…

MALICIOUS

PDF

75.1 KB Created: 2021-09-20 13:00:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14
MD5: 546ac19212e69beacdaf9f1d668735fe SHA-1: 9589e77f1cd76d1cb1a8aac87179f136efdd43e1 SHA-256: 38febfdd27ce9668e40d23922ae4f652805a9cd1afe8ab31c22e6dcbe2a59b0b
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file exhibits characteristics of a phishing or malware distribution lure, as indicated by multiple heuristics flagging it as a link farm pointing to potentially compromised CMS uploads and disposable hosting. The embedded URLs, such as http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/cmhkiud9hk21juo378po530e65/62330005814.pdf, are designed to redirect users to download files. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9916

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=download+gta+sa+lite+apk+for+android PDF link annotation
    • http://worldprint.su/userfiles/file/xusijevire.pdfIn PDF document text
    • https://bisleriuber.genefied.co/ckfinder/userfiles/files/48267321187.pdfIn PDF document text
    • https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/f23aa5f6877e3caeadd9a77b5d0faaea/mubabokuk.pdfIn PDF document text
    • http://gps-tw.com/CKEdit/upload/files/dosawob.pdfIn PDF document text
    • http://rsport.eu/yonexshop/static/file/42222609424.pdfIn PDF document text
    • http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/cmhkiud9hk21juo378po530e65/62330005814.pdfIn PDF document text
    • http://jjburgerut.com/uploads/files/bilakipegupavabegisot.pdfIn PDF document text
    • https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/16143d8be3ccf0---gilobojok.pdfIn PDF document text
    • https://harshahometutors.com/uniformkontakt/userfiles/image/files/32162663748.pdfIn PDF document text
    • http://bestofbeer.ru/ckfinder/userfiles/files/93647469449.pdfIn PDF document text
    • http://subventionsbetrug.de/wp-content/plugins/super-forms/uploads/php/files/rd13lrd50up733p92ecp0tehak/mixasexupawemetoritoguba.pdfIn PDF document text
    • https://dongytueduc.com/wp-content/plugins/super-forms/uploads/php/files/u3kdfvb4qv9oqhgotg8t91srlk/ramevakolonozije.pdfIn PDF document text
    • https://jiu-hang.com/upfiles/editor/files/60634313326.pdfIn PDF document text
    • http://rlponder.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/49141020919.pdfIn PDF document text
    • http://irths.com/upload_files/files/52356687870.pdfIn PDF document text
    • https://www.hdcorp.com.br/wp-content/plugins/super-forms/uploads/php/files/s2qr4lca5cr013vn94l85adevh/zugonifidad.pdfIn PDF document text
    • http://smalternatywa.pl/media/upload/files/d474d6c50a084c0996a75879c5b50753.pdfIn PDF document text
    • http://abwingstop.com/uploads/files/49727565898.pdfIn PDF document text
    • http://lifecontinues.ru/images/files/4567486096.pdfIn PDF document text
    • http://etalentlink.com/uploadfile/file///2021090811291483.pdfIn PDF document text
    • https://tekartltd.com/upload/files/lonuminebosigujobelo.pdfIn PDF document text
    • http://quickfix-poland.com/wp-content/plugins/formcraft/file-upload/server/content/files/161479aa2f3207---97811019093.pdfIn PDF document text
    • http://elrey-uslugi.ru/media/file/fawukoriruwemibag.pdfIn PDF document text
    • http://laptopplus.be/app/webroot/files/userfiles/files/63398739170.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c557.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC557 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000dd69.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD69 17080 bytes
SHA-256: 230515643eac1508a3b9b6b550525781b49657f35e54c5384b6373941a5fd1b1
font_02_sfnt_off000109d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109D0 10852 bytes
SHA-256: 4f13c4a4545f623d1f838c2d2d4d42bd7e59ad6bb11de4a69293fab8e7ad411e

Open this report in the interactive analyzer, or submit your own file for analysis.