Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ad5ad1b457d461e…

MALICIOUS

PDF

83.1 KB Created: 2021-09-03 13:57:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 3938d3cebce3bcec4ad937eb68a7519e SHA-1: eeb4e77776b007bd36b444ce467663be5a4ef284 SHA-256: 4ad5ad1b457d461e3290aadccfe0c6fe41335b638fb9971daf402818bdda6f18
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. It contains a large number of external URIs and is identified as a link farm, likely intended to manipulate search engine results or host phishing content. The presence of compromised CMS upload links further indicates malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/uplcv?utm_term=kenmore+elite+he5+dryer+repair+manual PDF link annotation
    • http://www.maderas-navarro.com/ckfinder/userfiles/files/xabasanuwisovegusu.pdfIn PDF document text
    • https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/c291f6c864e02a92b8dba33a0d44e4d8/kinube.pdfIn PDF document text
    • https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/c3cf39785ef9e80678b1974466454d93/55296937757.pdfIn PDF document text
    • http://youngthisyear.com/ckfinder/userfiles/files/wufawuzedejim.pdfIn PDF document text
    • http://jungam21.com/upfiles/file/1629157286.pdfIn PDF document text
    • https://www.synergyheart2heart.team/wp-content/plugins/super-forms/uploads/php/files/t2e86q86f7icj25gq99tgbhg6c/39470792446.pdfIn PDF document text
    • http://ersatzmonitor.de/userfiles/file/gofuzobuxaburep.pdfIn PDF document text
    • https://angkoronetour.com/userfiles/file/fugajowutamuwolox.pdfIn PDF document text
    • https://www.simcoerecovery.net/wp-content/plugins/super-forms/uploads/php/files/rqub5vb9vj8l35q5cmtu191fhs/77720848731.pdfIn PDF document text
    • https://www.cr-sdc.org/wp-content/plugins/super-forms/uploads/php/files/db4c3618abc0395d91426e5cd71e0a5f/xusofusixeminugilikimu.pdfIn PDF document text
    • http://seattleteriyaki3.com/uploads/files/40787023046.pdfIn PDF document text
    • http://argra.rs/wp-content/plugins/formcraft/file-upload/server/content/files/1612a3f8202a36---rinumipo.pdfIn PDF document text
    • https://www.18fire.com/wp-content/plugins/super-forms/uploads/php/files/58e6921a957698b8c8f6276d6bfbc0c1/13199521167.pdfIn PDF document text
    • https://www.chauffeur-prive-nice.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160920b79b0f35---juvavefokir.pdfIn PDF document text
    • http://www.lightingandhvacexpo.com/wp-content/plugins/super-forms/uploads/php/files/11964ea2933855004c99db9900cbd387/pibagodaposux.pdfIn PDF document text
    • https://aventura-agence.lu/userfiles/files/rofefugaxutabonas.pdfIn PDF document text
    • https://pluviaterra.mx/wp-content/plugins/super-forms/uploads/php/files/cfa93a79d915a73d37759b7933dcc77c/mizuwakozopula.pdfIn PDF document text
    • http://timelessmebel.ru/wp-content/plugins/super-forms/uploads/php/files/965b79030250d90f2cc9df7426d23e15/53799540633.pdfIn PDF document text
    • https://northstarexecutivesearch.com/wp-content/plugins/super-forms/uploads/php/files/f651e2529a78d44f385737ecc211f731/93692038757.pdfIn PDF document text
    • http://viaterrestre.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b0b2686cdc1---wadopavoniva.pdfIn PDF document text
    • https://www.guestquesttravelmedia.com/wp-content/plugins/super-forms/uploads/php/files/628uuajtlklg0vgpout78da1ie/tadisimixipa.pdfIn PDF document text
    • https://mavibusiness.it/file/47919566172.pdfIn PDF document text
    • http://cbcom.fr/ressource/site-image/files/91080282518.pdfIn PDF document text
    • http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/p8l4qa873i6s91abg3ld77badj/3187394930.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000decf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDECF 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000f6e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6E6 10828 bytes
SHA-256: a5cf48c5d416ff1fe9e69c1e08a713a042fe01d268b08ecb66634242204fac77
font_02_sfnt_off00010fa6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10FA6 17964 bytes
SHA-256: 2f6107de175de55d9ebead6522f111dd5d0264e6c8d8aeeca49a2935addec6dd

Open this report in the interactive analyzer, or submit your own file for analysis.