Malicious PDF — malware analysis report

Static analysis result for SHA-256 49aadaa5079ec046…

MALICIOUS

PDF

74.3 KB Created: 2021-09-03 08:24:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 911fae7575c89397ba6cfb4797e6a8cf SHA-1: 4d2557f0e4179f5797c71688de8529c31f2b5ae4 SHA-256: 49aadaa5079ec0469578bd786c46bb1a0533355063c284f35fca96b7830111d6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF was flagged by ML classifiers and ClamAV as malicious. It contains numerous embedded URLs, many pointing to compromised or disposable hosting, indicating a link farm designed to redirect users. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically identifies this pattern, suggesting the document's purpose is to host links for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9914

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ivelinabozilova.com/userfiles/file/dezuf.pdf In PDF document text
    • http://crystalsteakandstogie.com/clients/1/1d/1dbb6d5698303b6304ae84622e226a19/File/71507032523.pdfIn PDF document text
    • https://asiahealthcaredentalcentre.com/ckfinder/userfiles/files/97731995841.pdfIn PDF document text
    • https://www.icslights.com/wp-content/plugins/super-forms/uploads/php/files/92572be400416ffd9e1f5dc1e0e08691/fexetoka.pdfIn PDF document text
    • https://rlvanstory.com/wp-content/plugins/super-forms/uploads/php/files/6f3f14d82b6a67ec892fcbae3ff8c11e/didota.pdfIn PDF document text
    • https://nada70.org/userfiles/file/wusalakizuzemipaguko.pdfIn PDF document text
    • http://photographybynami.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cb855152d2---48521253398.pdfIn PDF document text
    • http://kiuruvedenlukio.fi/tiedostot/file/94335050358.pdfIn PDF document text
    • https://hmjrgoldhockey.org/wp-content/plugins/super-forms/uploads/php/files/06173eff45f70101d564d68f4e14975f/vimugonuzi.pdfIn PDF document text
    • https://forex-robo.org/wp-content/plugins/super-forms/uploads/php/files/0d954b5266bf239e3979c3157031557b/4607673020.pdfIn PDF document text
    • http://avanti-kuhni.ru/upload/files/minutagobujawewonu.pdfIn PDF document text
    • https://egokituz.org/files/galeria/files/88682759918.pdfIn PDF document text
    • https://www.davinci.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160e38fd7c366d---27455482021.pdfIn PDF document text
    • http://smolensk-bakaleya.ru/userfiles/file/bamowasasoka.pdfIn PDF document text
    • https://www.numberoneporthill.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca7606c7ad---95635513394.pdfIn PDF document text
    • http://tubietelbar.hu/uploadfile/22775262066.pdfIn PDF document text
    • http://barrospizzadb.com/uploads/files/93445171810.pdfIn PDF document text
    • https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d98388d6d8---48113203846.pdfIn PDF document text
    • http://mofrantech.com/userfiles/file/70525466432.pdfIn PDF document text
    • https://ceadersvalet.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c90bc97dd3---namunufige.pdfIn PDF document text
    • https://ka-base.no/images_content/file/15556881374.pdfIn PDF document text
    • http://orderkai.com/uploads/files/24132160205.pdfIn PDF document text
    • https://kayakbranson.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a0ed5566dcd---8693698242.pdfIn PDF document text
    • https://smartbrand.ro/mm/file/merorufixutisu.pdfIn PDF document text
    • https://oglethorpeclub.org/~oglethor/UserFiles/file/xixizovo.pdfIn PDF document text
    • http://allprintusa.com/admin/images/file/reratexetezemoromoke.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=principles+of+communication+lecture+notes+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bd6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBD6A 17112 bytes
SHA-256: 555da0153e43d49c596fefeafb73832f29cde5441848872b33864f638428d504
font_01_sfnt_off0000e9d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9D8 10884 bytes
SHA-256: 270cf09cbd9551891282c317a67abc97984a7a7639b5ea3999643232eb70c673
font_02_sfnt_off000102f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102F5 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.