Malicious PDF — malware analysis report

Static analysis result for SHA-256 4fb103be7928ef65…

MALICIOUS

PDF

91.5 KB Created: 2021-06-26 03:19:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 79756d6ac9f44cfbdd2e287b1e0a5d14 SHA-1: bdaf2975f772b13679ae0054ef365f1eb7719669 SHA-256: 4fb103be7928ef6583a26701c84e0d887919c3ab314bb4d1c49d527c59d48605
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a link farm with numerous URLs pointing to compromised WordPress sites, likely intended to lure users to malicious content. ClamAV detection and ML classification strongly indicate malicious intent, consistent with a phishing or malware distribution campaign. No scripts were extracted, but the structure suggests the PDF itself is the primary malicious component.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9822

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16094423b06eb5---xifubo.pdf
    • https://gfow.om/wp-content/plugins/super-forms/uploads/php/files/d2vhm5ssn93bpi44i7aqrg13ib/falinumavamopawa.pdf
    • https://zweiund40.com/wp-content/plugins/super-forms/uploads/php/files/d180jpn46l3numj8uvq5gcrgv4/sukaroranuwimiwuniwam.pdf
    • https://pankalconstructora.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098ac2d0b7e9---43646955612.pdf
    • https://amenagementsoleil.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c47b580139---nufumevolenafipudotes.pdf
    • https://travolution.travel/wp-content/plugins/super-forms/uploads/php/files/12bfe7979eac8edc8953f52fd29c914f/95403923363.pdf
    • http://bharatdarshan.net/rgroup/ckfinder/userfiles/files/62093144900.pdf
    • https://unitedcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a23219768a4---1614928128.pdf
    • https://pima-alarms.rs/slicice/file/zatenukenase.pdf
    • http://www.deopendeur.org/imgUser/file/gubaberojelemevudoreg.pdf
    • https://arihantgranites.in/wp-content/plugins/super-forms/uploads/php/files/2ima2dm8t248e8ua71cgpj3m22/jujutuwukuwepe.pdf
    • http://www.optionassurance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160845e8f1748e---66978378279.pdf
    • http://neuragen.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160b9c763c0290---tadawugeleda.pdf
    • https://leganordavigliana.it/uploads/file/xutada.pdf
    • https://www.isgs.org/wp-content/plugins/super-forms/uploads/php/files/7b1b4e9ffab3fb48e87fad4478e40c5b/nugofedawedudulo.pdf
    • https://slavica.ru/wp-content/plugins/super-forms/uploads/php/files/3dcb140b194c439af804523918c03458/60688069098.pdf
    • http://www.lifestaralberta.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092ad0701ce0---50400416048.pdf
    • https://www.guestquesttravelmedia.com/wp-content/plugins/super-forms/uploads/php/files/l33i33o8lg1e6ql9v82cuir87a/53435479557.pdf
    • https://digitaldaya.com/imagenes/file/99317772639.pdf
    • http://blessingsngo.in/userfiles/files/nurelikusuwisidejano.pdf
    • https://almoheetmanpower.com/public_html/userfiles/file/negewoj.pdf
    • https://ercrs.org/wp-content/plugins/super-forms/uploads/php/files/2r3g1mfs9ssl2a1mm43i7q4it9/54075579128.pdf
    • https://upbilbao.com/ckfinder/userfiles/files/bajusukexobegibuladepazup.pdf
    • http://www.linkkorea.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/160ab9ac0265bf---87574134310.pdf
    • https://aldaserwis.pl/ckfinder/userfiles/files/zowupiwen.pdf
    • https://www.jscorporation.co.in/wp-content/plugins/formcraft/file-upload/server/content/files/1607e821c2e4b2---pakipi.pdf
    • http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160791eac61d2b---meluve.pdf
    • https://www.bouldersudbury.org/wp-content/plugins/formcraft/file-upload/server/content/files/16090cbb29258c---redusefaserutofobezilej.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=pallet+furniture+plans+step+by+step+pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010389.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10389 16792 bytes
font_01_sfnt_off00011ba0.bin
a9d17fb4fbe8969f46e9954bf1f19efbe4e767a059e83779e5f1d5815d81feaf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BA0 10724 bytes
font_02_sfnt_off00013424.bin
95ea9053cd8a7920b75ea4d0a44652672bc25c5fd31308b8aa5fe92c5ae77bb9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13424 16316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.