Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f6037b7b0367aa3…

MALICIOUS

PDF

86.5 KB Created: 2021-07-03 08:21:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 97e8c61c8271e1489a7528c7a26fce20 SHA-1: c5ee87981b723e0032b8766875768dc8566c1671 SHA-256: 4f6037b7b0367aa307f07424868a4ca6b20966d55f0feaeaac4daa8a5c45450e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains a link farm pointing to numerous external PDF files hosted on various websites, many of which appear to be compromised or disposable. This suggests a phishing or malware distribution campaign where users are directed to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9835

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://czdashan.cn/uploadfile/file/2021050605104873499.pdf
    • https://amursvoidom.ru/media/files/62662882220.pdf
    • https://atphp.ch/userfiles/file/76162723440.pdf
    • https://photographerin.agency/wp-content/plugins/super-forms/uploads/php/files/v5a0jom4ro6mdc5pveguvn1j92/50699161434.pdf
    • https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1607463cc5d3de---38999649130.pdf
    • http://www.teeintact.com/admin/fckeditor/editor/filemanager/connectors/php/img/file/garetufelalatorisisaf.pdf
    • https://directprocessors.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608927eca6654---48620664274.pdf
    • https://www.havanasalsa-dance-tours.com/wp-content/plugins/super-forms/uploads/php/files/b9716c788c73eb32af719d255d4bd3d6/mozumitilexosixozaj.pdf
    • https://trucraftsmanship.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b2d69c0241---kuvuxovagem.pdf
    • https://refour.eu/wp-content/plugins/super-forms/uploads/php/files/6682d62081aee86ca1b5b1de1582982e/rozumebefokabom.pdf
    • http://bestapp4u.com/admin/uploadedfiles/file/parubozewi.pdf
    • http://soldearenales.com/galeria/files/vusedekagexukemek.pdf
    • http://anhuifan.com/upload_fck/file/2021-5-20/20210520014245470931.pdf
    • http://csc-020.com/userfiles/file/20210623070053_zkovox.pdf
    • https://inncredel.com/uploads/63842306105.pdf
    • https://www.saltriot.com/wp-content/plugins/super-forms/uploads/php/files/5a35300c569c183e173bb78771d6c225/14526425861.pdf
    • http://apsencollege.org/test/fckeditor/file/89254891238.pdf
    • http://merwepizza.com/upload/file/63920308772.pdf
    • http://sts-logistika.ru/wp-content/plugins/super-forms/uploads/php/files/3299429279b1d42e0e4ba54fbfb041e3/52348533855.pdf
    • http://plenaadoracao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b7dc28c7984---15461996943.pdf
    • https://aronabritcan.com/userfiles/file/rimidila.pdf
    • https://www.webhisto.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160ba0648ee94b---zixometubixesujutuvu.pdf
    • https://hmv.ir/wp-content/plugins/formcraft/file-upload/server/content/files/1606d029ebe10f---8429658531.pdf
    • http://www.maderas-navarro.com/ckfinder/userfiles/files/28003739067.pdf
    • http://mtlebanon62.com/clients/5/5e/5ee551a8be14a26d7d76bc5e90dd1372/File/6439227770.pdf
    • http://www.ncstarim.com.tr/wp-content/plugins/super-forms/uploads/php/files/1s10l0e88cco1a5ekmmsm5rmt0/kolewojojedosuroxi.pdf
    • https://www.escon.it/wp-content/plugins/super-forms/uploads/php/files/3573f837e8599fa9803b692d39cc81e0/64273769029.pdf
    • https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/1608ceafb5cee4---nejojeninufejuzora.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/S30rS-6n6vg/uplcv?utm_term=postal+2+android+apk
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee46.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE46 16792 bytes
font_01_sfnt_off0001065d.bin
b7a320a8ded0cd10bf011c79d3bc667467769c0ef6ab1478dd73463d20e0aaec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1065D 10464 bytes
font_02_sfnt_off00011e45.bin
b02d13d79f964158a41d51215bf9d6740e4230f4b8f8016c28873ec079c751fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E45 17912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.