Malicious PDF — malware analysis report

Static analysis result for SHA-256 50d336ebb215cde6…

MALICIOUS

PDF

74.7 KB Created: 2021-07-13 20:21:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-15
MD5: 8efffa609a101eeb891d50ffa16fd898 SHA-1: 378de213c01427f21e033ba9af1df4a24a877c90 SHA-256: 50d336ebb215cde624dd0b4457d7b4b8dee62063512c74e95913e6acb6aaa82e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document functions as a link farm, containing numerous URLs pointing to compromised websites and disposable hosting, likely serving as a lure for phishing or malware distribution. The presence of multiple external URIs and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic strongly support this attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=barros+power+and+60 PDF link annotation
    • http://teplolux72.ru/upload/file/saragulezijopodubowapi.pdfIn PDF document text
    • http://drstevealbrecht.com/wp-content/plugins/super-forms/uploads/php/files/14f703c4e92884beba5e3e8d12b4284a/bixaxerejilaweratagesoxel.pdfIn PDF document text
    • http://i-dron.cz/data/file/nedobewotavi.pdfIn PDF document text
    • http://zawayakw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160943b96b644a---vasewamebeletuvu.pdfIn PDF document text
    • http://www.holderit.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac7d248033c---ravedivujudiruzebafo.pdfIn PDF document text
    • https://www.qlsny.com/wp-content/plugins/super-forms/uploads/php/files/776e88cd7cad6279b3e09a52a80534eb/bifonovafisidoluvapiseb.pdfIn PDF document text
    • https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/30976d744c98ff3423efe439021b3112/34857551283.pdfIn PDF document text
    • https://kfz-gutachter-oliver-schiller.de/wp-content/plugins/formcraft/file-upload/server/content/files/160c539eb36ee7---32741542327.pdfIn PDF document text
    • https://www.avenueroadadvertising.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c40f9d8f83b---tuvasojovubukum.pdfIn PDF document text
    • https://chefinhogourmet.com/wp-content/plugins/super-forms/uploads/php/files/ea1901b81fd8b0ab8d76f039b15e2bd8/41390948280.pdfIn PDF document text
    • https://rfcorporation.net/wp-content/plugins/super-forms/uploads/php/files/bfa94720848e986715180b41f75361c4/kudevaviwuremevijunukuxu.pdfIn PDF document text
    • http://www.gunyagder.org.tr/wp-content/plugins/super-forms/uploads/php/files/o9olfoi3i84dn77cu7ugd2utf3/sapezi.pdfIn PDF document text
    • https://www.straightmyteeth.com/wp-content/plugins/super-forms/uploads/php/files/8400274dbf9b7efa128ef15afd4295da/sewojoziminibiwawug.pdfIn PDF document text
    • http://notarbrazda.cz/userfiles/file/towemelipojusazekavol.pdfIn PDF document text
    • https://fallsplat.se/file/19778706806.pdfIn PDF document text
    • https://goldenparadisestsimons.com/wp-content/plugins/super-forms/uploads/php/files/020b08e759847804677af89469176745/62218240842.pdfIn PDF document text
    • http://nnk.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160b40ba8b98ba---kusuposedusatonek.pdfIn PDF document text
    • http://lubrifianti-auto.ro/files/file/38810294058.pdfIn PDF document text
    • https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/160b43518cc8f1---dotidubamajegiwolij.pdfIn PDF document text
    • http://katachizu.com/img/news/files/bakapupikoxabadirem.pdfIn PDF document text
    • https://jfefood.com/wp-content/plugins/super-forms/uploads/php/files/f14de00bc46091aff10eaf57d7c345d7/bofepubagutuloridusuja.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c132.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC132 16652 bytes
SHA-256: b8c56d470c8cf87bd96d5406ca1c58c869700a7fb16a81270a5bccceb1ca43b4
font_01_sfnt_off0000ec33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC33 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0001044a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1044A 10580 bytes
SHA-256: 0d897cb3c1df10e297be81e1b5496b88fd65f1a0034f95ab2777e65fb28ef445

Open this report in the interactive analyzer, or submit your own file for analysis.