Malicious PDF — malware analysis report

Static analysis result for SHA-256 473323659d1faa3f…

MALICIOUS

PDF

94.4 KB Created: 2021-07-29 20:45:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-03
MD5: 2d2ae559841d5ca8d090a7429bcb4755 SHA-1: 031d7d1e1f78c98ab64e00a917cfcc2ed9ba4e54 SHA-256: 473323659d1faa3f217a544e5b1cbbdc5715567cca10ecb7558b96847cce76fa
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many of which are hosted on compromised CMS uploads, suggesting a link farm designed to redirect users to potentially harmful content. The presence of embedded URLs and the nature of the heuristic firings point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9897

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infravoip.com/wp-content/plugins/super-forms/uploads/php/files/e24b11b4be1e008f2feec8e582d222ed/bexoxivizexadaxotisowepos.pdf In PDF document text
    • http://mankatomnclassof71.com/clients/e/e0/e0e8961458839910853a12af65841b27/File/72534871160.pdfIn PDF document text
    • https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f30d24a5f6e---41582431282.pdfIn PDF document text
    • http://multiseal.com.ph/wp-content/plugins/formcraft/file-upload/server/content/files/160e8cf4559846---58453660020.pdfIn PDF document text
    • https://bellevuecommunityfoodbank.org/wp-content/plugins/super-forms/uploads/php/files/06f6403ae11b722af997818386c0da5d/18282071813.pdfIn PDF document text
    • http://startent.ru/SITE/files/editor/file/lifusaxodetopa.pdfIn PDF document text
    • https://robinio.de/wp-content/plugins/super-forms/uploads/php/files/pljmqm62q54nr2de25o98pdbq1/xolotaloladasoxeg.pdfIn PDF document text
    • https://torrentclub.vip/wp-content/plugins/super-forms/uploads/php/files/dnel1adpirttcdmrm70r1em5a8/98101758925.pdfIn PDF document text
    • http://dynamic1984.com/user_file/file/jinodabetenumurir.pdfIn PDF document text
    • http://primebrokeragetx.com/ckfinder/userfiles/files/30782824396.pdfIn PDF document text
    • http://grupomarsamo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099b33496f2b---43736630947.pdfIn PDF document text
    • https://kogan-photo.ru/wp-content/plugins/super-forms/uploads/php/files/fe475180c0f5c11a2ea609a30f7e60fc/muvapunoxujatow.pdfIn PDF document text
    • http://koreadramatour.com/FileData/ckfinder/files/20210728_A1B33709666B1BCA.pdfIn PDF document text
    • https://signika.pl/Upload/file/bawezupuzobunirunikujup.pdfIn PDF document text
    • https://vishalahospitality.com/ckfinder/userfiles/files/91974309770.pdfIn PDF document text
    • https://ajwatravel.com/wheelmarine/userfiles/file/fokegos.pdfIn PDF document text
    • https://lucky-erotic-massage-bucharest.ro/ckfinder/userfiles/files/lefixubezutusifun.pdfIn PDF document text
    • http://www.anjhimayath.com/upload/file/zepojemirulezi.pdfIn PDF document text
    • https://www.synergyheart2heart.team/wp-content/plugins/super-forms/uploads/php/files/ll15kce7keiminoloog9joa91g/5326146720.pdfIn PDF document text
    • http://reiki-roots.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16083a2aa8f5a6---foruluwamux.pdfIn PDF document text
    • http://actionelectric.pt/www/wp-content/plugins/formcraft/file-upload/server/content/files/16093015757b78---37306269879.pdfIn PDF document text
    • http://accurateverdicts.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b744c602542---lupijajafimamutap.pdfIn PDF document text
    • https://hoakhanh.vn/uploads/image/files/12361650231.pdfIn PDF document text
    • https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/4257d41239f1e3e68dc5eb8402f0035b/senavujulatazurenorov.pdfIn PDF document text
    • http://thaiboxes.com/piceditor/file/16795300976.pdfIn PDF document text
    • https://www.davidwoodpersonnel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160807f0530478---18625434797.pdfIn PDF document text
    • https://teplitsyoptom.ru/wp-content/plugins/super-forms/uploads/php/files/0d80b790b2da284b782b26743089307e/76726902560.pdfIn PDF document text
    • http://paitoonbox.com/userfiles/files/91677110756.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=english+calligraphy+writing+practice+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A67 17548 bytes
SHA-256: d5aa8e2e1d95bd35870eeb08ef8f80d20659955c207d3880fc07d03d1c7e57ef
font_01_sfnt_off0001380e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1380E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00015025.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15025 10960 bytes
SHA-256: c195dfe8dc791759f77824807f70edb6bc112e53221912c1d0bb047bdca9caa5

Open this report in the interactive analyzer, or submit your own file for analysis.