Malicious PDF — malware analysis report

Static analysis result for SHA-256 439d0f6490c8cd90…

MALICIOUS

PDF

104.5 KB Created: 2021-07-05 22:43:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 16dec7ee8da0a9081cd978281b272577 SHA-1: ee1143cd504d79128955437245cd5719a020e75e SHA-256: 439d0f6490c8cd90446e350afdbb66c5634eee033e97982abba3c6a3508653c9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1190 Exploit Public-Facing Application

The PDF file was flagged by ML classifiers and ClamAV as malicious. Heuristics indicate it functions as a link farm, pointing to numerous compromised WordPress sites hosting PDF files. These URLs likely serve as lures for phishing attacks or as distribution points for further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9773

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.caribbeandentist.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d3420671288---79063511667.pdf
    • http://www.cavice.fi/tiedostot/files/torituzamomo.pdf
    • https://benchmarktransitions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609a1ffe24bf6---kozalekaluxep.pdf
    • https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/3ad1dc7d2b1646a14dc26171d2d522e2/tawulegexo.pdf
    • http://blesk-stroy.ru/userfiles/files/64715540036.pdf
    • https://www.corridar.com/wp-content/plugins/super-forms/uploads/php/files/eds1jrruch5su299aukshiu6q3/82856571282.pdf
    • http://xn--90ad5ackt1d.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/5b5fd394177e13fd9aa9cf40ccd9ecab/weporivisiven.pdf
    • https://growlocals.com/wp-content/plugins/super-forms/uploads/php/files/145dc1a9383d634c4d542cebd67e0754/97411325389.pdf
    • https://cwlighting.com/wp-content/plugins/super-forms/uploads/php/files/da1e62cd2615eff94ad876af871d228b/60757183539.pdf
    • http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/2251d00a9ed4ed78b703002b4517665f/denilamezazi.pdf
    • http://schouteninterieurwerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c8e4ab36d4c---femojeves.pdf
    • https://baconbites.com/wp-content/plugins/super-forms/uploads/php/files/hv2k826setgmgao215pn2eobk5/janogevabixokatubex.pdf
    • http://euro520.net/userfiles/file/1621723255765774730.pdf
    • http://expertcomptablecourreges.fr/michel_courreges/userfiles/file/4012374694.pdf
    • https://ehblending.com/wp-content/plugins/super-forms/uploads/php/files/05c50b0f45eba21a945bb990564cef03/misite.pdf
    • https://rrvchefs.com/wp-content/plugins/super-forms/uploads/php/files/28dd01a247460b06a24b2530fcdabf67/kawabofivamuduziriper.pdf
    • https://www.prestigeautobody.com.au/wp-content/plugins/super-forms/uploads/php/files/37522ae22ca60dee0c3976f9b11b5e3b/95837161342.pdf
    • http://nomaquito-travel.com/editor-images/88877384912.pdf
    • https://conexus-study-abroad-travel.com/ckfinder/userfiles/file/binaxakusosovekozugof.pdf
    • http://acecaalcoy.com/userfiles/file/bomijoxafekoxu.pdf
    • https://bikinibody.be/wp-content/plugins/super-forms/uploads/php/files/ki96voobqjs8bgeh42afc6ifba/katojuzukazupilemepoga.pdf
    • http://www.kidnuri.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092e91da0aa3---rarigekamajiwele.pdf
    • http://www.training4thefuture.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606f54260d5ad---kedofugivan.pdf
    • https://evocative.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160b163a9b6919---13258762564.pdf
    • http://kayapaliinsaat.net/file/17117771512.pdf
    • http://www.moteco.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607eb6e3e4b87---38398817504.pdf
    • http://cuahuyhoang.com/media/ftp/file/68824651651.pdf
    • http://erbilsunhotel.com/wp-content/plugins/super-forms/uploads/php/files/rhmqsm7mkkonc56s7n4lt1mlv2/89637900099.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=low+visibility+taxi
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013837.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13837 16792 bytes
font_01_sfnt_off0001504e.bin
b79c41cc124392a0b14e43901559b4d0af9fec774fe07ae12799d0f4bbcb7eb1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1504E 10232 bytes
font_02_sfnt_off0001677c.bin
a3b4e4c6141ed622158519bf91b033523d871af32865105545f5fa94a96dd92d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1677C 17204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.