Malicious PDF — malware analysis report

Static analysis result for SHA-256 4bb9c39f6c72240a…

MALICIOUS

PDF

121.0 KB Created: 2021-06-27 10:19:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 574bfee301b4f25e7f3a6917ee4d9edd SHA-1: 8d04ef68eca85d4600b1fd0020e7140245b50bb2 SHA-256: 4bb9c39f6c72240a0fb9daf31cb4b91ce215dea75a4e381f6808f8cd439140f4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous URLs pointing to compromised WordPress sites, suggesting it's used to redirect users to phishing or malware hosting sites. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports this, indicating a pattern of using disposable hosting for link farms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9795

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=attribute+css+selector
    • https://teenvolunteerdallas.org/wp-content/plugins/super-forms/uploads/php/files/502c1fe180c4c9c3c7bab7c1e08512fd/62202636715.pdf
    • http://www.combatsim.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160d4a0c63fd37---dokisuwitufogamel.pdf
    • https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/b77a23c9b791f96de4043bcb97332569/zegusu.pdf
    • https://bistro-8.com/wp-content/plugins/super-forms/uploads/php/files/bf378962ee5a723de2f31a4c8e4f72da/xofijimedojesegudelo.pdf
    • https://247hvac.ca/fabulous1/uploads/files/wamarifepaxolevexonet.pdf
    • https://dipinkrishna.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607335071ea2c---63676655771.pdf
    • http://paintingservicesonline.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16091c59d55e9e---kapibevesipagudidevufa.pdf
    • https://www.alignerco.ca/wp-content/plugins/super-forms/uploads/php/files/e8363ea63653ed748d9b520841a52861/kufupaduximumudokezejagal.pdf
    • https://ficsllc.com/wp-content/plugins/super-forms/uploads/php/files/389rsoiu7fj4gsm4gnf8i36moe/61771635250.pdf
    • https://fedico.ca/upload/editor/file/50488619383.pdf
    • http://omniatel.it/wp-content/plugins/formcraft/file-upload/server/content/files/160ba7f961b2bc---nanimobutilana.pdf
    • http://www.kindytennis.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a7d184f2960---fepedojala.pdf
    • https://sygimportaciones.com/wp-content/plugins/super-forms/uploads/php/files/nn62s80gb3nhg4ea16f1aq360p/21882124297.pdf
    • https://solarconsulting.org/wp-content/plugins/super-forms/uploads/php/files/3f7de6e28ae7ba2197b530b7d1e2775d/56746296864.pdf
    • http://jkmdc.com/aversystem.com/userfiles/file/rugokiragawizonon.pdf
    • https://lakeshoresmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/33tkmmk679or437djb8io77146/86110709906.pdf
    • http://banglenhospital.com/UserFiles/File/bagiku.pdf
    • http://markone-tools.com/upload/files/tinalabosejitolivof.pdf
    • https://songuryazilim.com/calisma2/files/uploads/rezibufapizese.pdf
    • http://makingthegradetexas.com/clients/d/d4/d4716c73f098ea79da165a2194b6736a/File/romawewamurukaminoposaton.pdf
    • http://syuncyoku.jp/upload/file/wogowawosoteperenatimuzax.pdf
    • https://atcotourismtravel.com/userfiles/file/zufidowamuzewakur.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014be8.bin
1ecc84682375f83c9909e3555bbf52168545de78f8506b27e1c656374e8e6207		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14BE8 10176 bytes
font_01_sfnt_off000162d7.bin
80d2d3c32f152d6550993efb6cc4a86d3b7b1b4db253dc039430d61583574647		 pdf-font-stream PDF embedded font (sfnt) at offset 0x162D7 23048 bytes
font_02_sfnt_off00019de3.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19DE3 16792 bytes
font_03_sfnt_off0001b5f4.bin
0e3d63f173342003c62a86c726d4d5a85e7f52d44cf06618766a4fa08a0866bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B5F4 16088 bytes
font_04_sfnt_off0001cb1e.bin
d840a7985c50d2c6f58da2033baf3a912f736d199c2f94605fd88ab38da7841f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CB1E 2472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.