Malicious PDF — malware analysis report

Static analysis result for SHA-256 45e3f72636b4dc20…

MALICIOUS

PDF

96.1 KB Created: 2021-09-07 02:20:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05
MD5: ed6704c683a26583efb7ccfaff0acc34 SHA-1: a6cda6a52b7216acd41f2191c865f63b5caa06f5 SHA-256: 45e3f72636b4dc2016142f617b8ca1a224c700e85b374f382b95d951cccfa867
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs, many of which point to compromised WordPress sites. Heuristics indicate this is a link farm designed to host malicious content. ClamAV detection and ML classification confirm its malicious nature, likely as a phishing or redirection tool.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160c9a2012f49c---24100760627.pdf In PDF document text
    • https://www.arc-welding.co.uk/wp-content/plugins/super-forms/uploads/php/files/ecucsskkbij992t8aqhg7ehnqm/gudovaf.pdfIn PDF document text
    • https://gianlucabruno.it/dati/upload/file/58286510157.pdfIn PDF document text
    • http://osullivanspressurewashing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4b0dfb2d82---piwoxizumiwurokokolu.pdfIn PDF document text
    • http://kantoromega.pl/userfiles/file/70933252869.pdfIn PDF document text
    • http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d6f329d953---famelisizawosanaradulito.pdfIn PDF document text
    • http://banning64reunion.com/clients/a/a7/a71e9339640f4be667ed55590a288245/File/55679837096.pdfIn PDF document text
    • https://www.hinogas.com/wp-content/plugins/super-forms/uploads/php/files/0glhs6cev50d6348ffe11nat9c/genifurugetof.pdfIn PDF document text
    • http://designpavelzapletal.cz/files/file/36754064964.pdfIn PDF document text
    • https://unserbiokorb.ch/userfiles/file/3329980120.pdfIn PDF document text
    • http://www.blueoak.fr/image/file/roxelopireno.pdfIn PDF document text
    • https://teenvolunteerdallas.org/wp-content/plugins/super-forms/uploads/php/files/d5d130339352d927eb6caca72697299e/lawafuzuselizez.pdfIn PDF document text
    • http://vizugy.hu/uploads/files/mupiminibinivefa.pdfIn PDF document text
    • http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160cb2b957f531---xosiwixolusunuw.pdfIn PDF document text
    • http://shannonlakeestates.org/fck_images/file/99580172813.pdfIn PDF document text
    • https://wipaphun.com/UserFiles/File/8025956383.pdfIn PDF document text
    • https://www.vedaaz.com/wp-content/plugins/super-forms/uploads/php/files/f95b4af04bc08f994d1c476c7d2576dd/67082452208.pdfIn PDF document text
    • http://hitechdentalhouston.com/uploads/files/zodoxegogevivodedisej.pdfIn PDF document text
    • http://aksaaydinlatma.com/img/editor/image/file/56050772765.pdfIn PDF document text
    • http://michaelwilliamslaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/diketa.pdfIn PDF document text
    • http://chocolatycakes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160786e16345fe---65908718707.pdfIn PDF document text
    • http://cdkuys.handysociality.com/upload/files/xakafitivesikovobu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=tcpdf+no+header+linePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011558.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11558 17992 bytes
SHA-256: 84a3d2bda22b4aee436e5c79016aa3c1ad67b28cf4c462ea2d7922176319ed3e
font_01_sfnt_off0001436c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1436C 10412 bytes
SHA-256: 9792fd84598295cee2112d847a182f65725a1e6761970516be06c066479bcbb9
font_02_sfnt_off00015ade.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15ADE 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.