Malicious PDF — malware analysis report

Static analysis result for SHA-256 5035b208615dfefd…

MALICIOUS

PDF

104.0 KB Created: 2021-06-19 00:21:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 443993b9e5de8050b75b0cedef18f869 SHA-1: 21f73633a3c1867e687ce723d2a521a1a03e4da4 SHA-256: 5035b208615dfefd446f2ff6c94b3915dba6b7dabb5a1b0d5e1089f3b6e1ed64
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating it likely contains malicious content. The heuristics reveal it functions as a link farm, directing users to multiple compromised or suspicious websites hosted on disposable domains. The presence of numerous unknown URLs suggests an attempt to distribute malware or phish for credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/73f5773a7eb4038aaacafb877ce59e6a/pepunujowebikanizavudu.pdf In PDF document text
    • http://wksystems.net/HotelEstimator/userfiles/file/9820129164.pdfIn PDF document text
    • http://getawaynewzealand.co.nz/wp-content/plugins/formcraft/file-upload/server/content/files/160853a576aaeb---voweludo.pdfIn PDF document text
    • http://www.recetasyconsejos.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4d3c3cdfa3---57271020758.pdfIn PDF document text
    • http://bubblesoflove.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a150e8a78ab---javominira.pdfIn PDF document text
    • https://hospvetcentral.pt/site/upload/file/44208595038.pdfIn PDF document text
    • https://www.lenoir-elec.com/wp-content/plugins/super-forms/uploads/php/files/ca4bh6673ft854ne3q8pa7d116/78810484624.pdfIn PDF document text
    • https://serwisnawigacji.pl/userfiles/file/24068214392.pdfIn PDF document text
    • http://pileshoppen.dk/userfiles/file/porusamozamav.pdfIn PDF document text
    • https://www.hemoroidklinigi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160704871a5694---kawufogotat.pdfIn PDF document text
    • https://kantankacreative.com/wp-content/plugins/super-forms/uploads/php/files/874d612152c8c33cc4fae9355d84faf7/77621872952.pdfIn PDF document text
    • https://portsidestrategies.com/wp-content/plugins/super-forms/uploads/php/files/7f5ab6fd5ae71db97fca0536a5d65bbe/83536651418.pdfIn PDF document text
    • https://ols.lighting/wp-content/plugins/super-forms/uploads/php/files/cdd7ee396d39abc49bef277bbd192ab8/sifizezefagelus.pdfIn PDF document text
    • https://akproauto.com/nbloom/fckuploads/file/toper.pdfIn PDF document text
    • https://www.advids.co/wp-content/plugins/formcraft/file-upload/server/content/files/16093ff734c751---16014832255.pdfIn PDF document text
    • https://mamproducciones.es/wp-content/plugins/formcraft/file-upload/server/content/files/160766c4587750---29871522329.pdfIn PDF document text
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/i3dlk1jvcf1406c599vm4e909v/dofepafixen.pdfIn PDF document text
    • https://dbjadow.pl/attachments/file/patatudezemewujodutawana.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=happy+birthday+cake+renuPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8D2 6588 bytes
SHA-256: 4e1a9c4cb32f1bc4ff176ae4dc1460c31b2d267bf2def0252f23ad2731e7be72
font_01_sfnt_off0001094b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1094B 5216 bytes
SHA-256: 3d69b3c75d170d6a52edbd940933a6935e1d20c8999370ed1a56dd33b75999d0
font_02_sfnt_off00011b00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B00 3720 bytes
SHA-256: d0c9e33916e9e64e42e31bcf0d345f6c2fcd41735b1a34df0119bd0eb1094281
font_03_sfnt_off0001265c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1265C 9448 bytes
SHA-256: 06f7ae8539c383ec86fbad03565719b78c964e52948a6520ce923b8f4755d3f9
font_04_sfnt_off00014384.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14384 12448 bytes
SHA-256: 1f067cadff10672dacbbf00b728cf2812ae21fa85893acffb5ffee59d008dab5
font_05_sfnt_off00016c8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16C8A 12120 bytes
SHA-256: ba78a2ae02811030cb9726dbc23b71d21946f4327e8e0632c2989af406236667

Open this report in the interactive analyzer, or submit your own file for analysis.