Malicious PDF — malware analysis report

Static analysis result for SHA-256 486894ddf423fdbc…

MALICIOUS

PDF

85.0 KB Created: 2021-08-26 22:45:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14
MD5: 2f9a5440755d0742b4a5600a34199f04 SHA-1: 7dba8bbd0f9fdb61be720dec75400c2b175420c9 SHA-256: 486894ddf423fdbc4bcd0f906c9e6b226916d3f21c259c70e3aa0564f24aa8f1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF was flagged by multiple heuristics as malicious, including a high-confidence ML classifier and ClamAV detection. It contains numerous embedded URLs pointing to external sites, many of which are hosted on compromised CMS platforms or disposable domains, suggesting a link farm or phishing lure. The presence of these links indicates an attempt to redirect the user to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://1careglobal.com/upload/files/mevipejit.pdf In PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b2cf0810008---rubibidelo.pdfIn PDF document text
    • http://ciccioinpentola.com/userfiles/files/lexabivaza.pdfIn PDF document text
    • http://halvani.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c0280c8bfdb---bowexigigexosak.pdfIn PDF document text
    • https://www.d-table.com/wp-content/plugins/super-forms/uploads/php/files/3d706282809e50f11ee69d4c177d5945/sowojukuzatarimixekipoj.pdfIn PDF document text
    • https://sdyh.gr/wp-content/plugins/super-forms/uploads/php/files/r3325los4jc4dl4o8fdpmhcev4/loliwoxi.pdfIn PDF document text
    • http://ottotech.center/userfiles/file/lufiwuzixirudomo.pdfIn PDF document text
    • http://asbufestival.com/uploads/FCK_files/file/jaluruxin.pdfIn PDF document text
    • https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160af69854f1ab---voroti.pdfIn PDF document text
    • https://www.lesson-online.org/wp-content/plugins/super-forms/uploads/php/files/r9dfb7vboir8trsfn7d0m8o847/34914428987.pdfIn PDF document text
    • http://driver-jazda.pl/upload/file/57374449489.pdfIn PDF document text
    • https://consultingexpert.eu/fckeditor/userfiles/file/mupirusile.pdfIn PDF document text
    • http://raljob.com/userfiles/file/gefonovetifawikaziwiwemol.pdfIn PDF document text
    • http://pileshoppen.dk/userfiles/file/12383357066.pdfIn PDF document text
    • http://www.sempresaude.net/wp-content/plugins/formcraft/file-upload/server/content/files/160c916eca7bed---xelevefav.pdfIn PDF document text
    • https://legacyltg.com/wp-content/plugins/super-forms/uploads/php/files/0066187e0361e58e1b33977f8dd36284/puveved.pdfIn PDF document text
    • https://wscnaturalhealings.com/wp-content/plugins/super-forms/uploads/php/files/a33ba86756fd42e78a8dd6b2a374bc1c/82288837211.pdfIn PDF document text
    • https://cochleartudaskozpont.hu/files/tijijimowotasutig.pdfIn PDF document text
    • http://brownmahonefamilyreunion2015.com/clients/7/71/71b8b7811cafefaf2288418346dc0658/File/zebesel.pdfIn PDF document text
    • http://festivaldeliteraturadepereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/16074490f65b18---87095977597.pdfIn PDF document text
    • http://www.mostenpo.jp/userfiles/files/48745668553.pdfIn PDF document text
    • http://bridgesonthepark.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b7d5528117f---powajumixifaferusun.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=a+haunted+house+full+movie+downloadPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e658.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE658 16976 bytes
SHA-256: 67848e69c2f44237e808735b2aa569c574b876e6443ca155ef0cd4799db48fa1
font_01_sfnt_off000112d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112D1 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00012ae8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12AE8 10752 bytes
SHA-256: e61f6c50955c8f56418e83c628db266ed32f0f44a097c39de053c1031f0fdce8

Open this report in the interactive analyzer, or submit your own file for analysis.