Malicious PDF — malware analysis report

Static analysis result for SHA-256 522361db4bbd01c9…

MALICIOUS

PDF

79.0 KB Created: 2021-09-05 22:28:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: db9c6319a4baaaa6db6a02a5ccea6e9e SHA-1: c26f35119fc680e4e23ea3a3e53847469ef7b951 SHA-256: 522361db4bbd01c919223dbc68eeb1d12abc1090400ce4f0a8ea65c2454e0581
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF was flagged by ClamAV as a phishing trojan and by an ML classifier as malicious. It contains numerous links, many pointing to compromised CMS upload directories or disposable hosting, suggesting a link farm designed to redirect users to malicious sites. The document body is unreadable, but the heuristics indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9833

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dlmberatung.ch/userfiles/files/vabepasuvirakiterepa.pdf In PDF document text
    • http://sip7.online/wp-content/plugins/super-forms/uploads/php/files/d6f69b698443743998771c323dfa5bb2/gaxowusufibuzoneno.pdfIn PDF document text
    • http://leinerpakgelatine.com/survey/userfiles/files/bilekekuwevujejago.pdfIn PDF document text
    • http://ingegnasrl.com/userfiles/files/pujirunoruvatimazurado.pdfIn PDF document text
    • https://ystechpro.com/nbloom/fckuploads/file/lanukeje.pdfIn PDF document text
    • http://thermcom.cz/userfiles/file/54458388845.pdfIn PDF document text
    • https://heritagelogs.com/wp-content/plugins/super-forms/uploads/php/files/04no5uvorcnsfhftaqt077hbth/lakimasopap.pdfIn PDF document text
    • https://adbadog.com/wp-content/plugins/super-forms/uploads/php/files/bb04ae58e05dd8170b653bb6c7be6568/karejerokevifejibepogex.pdfIn PDF document text
    • https://readxyz.com/wp-content/plugins/super-forms/uploads/php/files/70d845d9bd85543a6f8ace646193fe8c/73744704685.pdfIn PDF document text
    • https://stdtekstil.com/upload/ckfinder/files/37778838678.pdfIn PDF document text
    • http://www.laterveer-biesenbeek.nl/ckfinder/userfiles/files/43708314095.pdfIn PDF document text
    • https://festivalecolo.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607e50139f2e0---wuvufejesatuxadotefojo.pdfIn PDF document text
    • http://graham1978.com/clients/79565/File/pavizufitok.pdfIn PDF document text
    • http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b9de8aa02e---63719990614.pdfIn PDF document text
    • https://driftwoodcc.com/userfiles/files/lovoluruxiso.pdfIn PDF document text
    • http://steps4cancer.org/clients/a/a7/a78c374070a178914b502abaf3db82b8/File/61258591342.pdfIn PDF document text
    • https://talaa-obour.com/webmisr/uploadwebmisr/file/jopuzowipesokotekage.pdfIn PDF document text
    • http://duocthientam.com/uploads/ckfinder/files/12927834332.pdfIn PDF document text
    • http://www.mtpartnersfl.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d08da04656---fizuzomuwelot.pdfIn PDF document text
    • https://californiaoptionsrealestate.com/wp-content/plugins/super-forms/uploads/php/files/3d4b989b990ab7873502bcd61b15741b/pizurarilifadaf.pdfIn PDF document text
    • http://re-view.online/fckFiles/file/95872772511.pdfIn PDF document text
    • https://swotin.com/wp-content/plugins/formcraft/file-upload/server/content/files/160988d47873b0---lifeluduwofu.pdfIn PDF document text
    • https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/050s1c0o3avo2t57e6m7kpfppc/zadenis.pdfIn PDF document text
    • https://miet.hu/kepek/defegavewavawomazuzoliwo.pdfIn PDF document text
    • https://ailani.org/wp-content/plugins/super-forms/uploads/php/files/42e5e2f079d9e1b96dae53b002b9445b/12634355935.pdfIn PDF document text
    • http://www.prunay-en-yvelines.fr/ckfinder/userfiles/files/10133012497.pdfIn PDF document text
    • http://sziszolg.hu/editor_up/19364541651.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=ancient+greek+gods+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d181.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD181 10660 bytes
SHA-256: d559397725840c59bdbc3e86d2b3e5b11c84b470dfc69925fe6c116999051a0f
font_01_sfnt_off0000e9de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9DE 17756 bytes
SHA-256: f6103e95b7afe5e3aedf55a2d5e12d27560377b5aff5ff769b57866aad088083
font_02_sfnt_off00011698.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11698 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.