Malicious PDF — malware analysis report

Static analysis result for SHA-256 5249fa18db1f2e95…

MALICIOUS

PDF

73.2 KB Created: 2021-10-12 00:30:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23
MD5: 5ade6c1763c0765c7fe5c42c668ef7d3 SHA-1: 9b4883b4a477d305db4c8dc37bc72ac2f4eeb395 SHA-256: 5249fa18db1f2e955b35f71ad08bd2e09e28e783bec90fd95b963a71ed4f6ff6
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF file detected as malicious by ClamAV and an ML classifier. It contains embedded JavaScript, which is a common technique for executing malicious code within PDFs. The document also features a link farm pointing to compromised WordPress upload storage, suggesting an attempt to host or distribute further malicious content. The presence of embedded JavaScript and external links indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zazilha.com.mx/wp-content/plugins/super-forms/uploads/php/files/8ab60487c2d5b818d8502def2705eee4/napeluzudipid.pdf In PDF document text
    • http://promocode.lu/userfiles/files/jelalokuv.pdfIn PDF document text
    • http://shinaval.ru/userfiles/file/36965441906.pdfIn PDF document text
    • https://www.techsrollout.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615ed44698a28---3853506234.pdfIn PDF document text
    • https://homestayhoian.thamtuddt.com/uploads/image/files/90375249841.pdfIn PDF document text
    • https://k-kompany.ru/wp-content/plugins/super-forms/uploads/php/files/4f59dd9d06d20ad7be18a94a7725bdff/tepunifafakokozugubup.pdfIn PDF document text
    • http://sumbulefendiegitimvakfi.com/resimler/files/zazetimudogewetidop.pdfIn PDF document text
    • http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/161443f077659a---34706993541.pdfIn PDF document text
    • https://www.wappa.com.au/siteadmin/ckfinder/userfiles/files/84949169987.pdfIn PDF document text
    • http://jd6618.com/jd6618/file/2021-10/file/LwpCms2021_10_12_05_10_07_2583.pdfIn PDF document text
    • https://hatinhjobs.com/upload/files/jugopekunoze.pdfIn PDF document text
    • https://mytalk7.com/_UploadFile/Images/file/1849654582.pdfIn PDF document text
    • http://web-news.eu/www/pkpar/userfiles/file/sofunutisixotage.pdfIn PDF document text
    • http://megalaserasia.com/upload///1829598534.pdfIn PDF document text
    • http://istvietnam.com/rich_editor/file/75558054228.pdfIn PDF document text
    • http://www.jasolasia.com/image/upload/File/67698442494.pdfIn PDF document text
    • http://aedjtj.pretty-match.com/upload/files/jowutudusigurebomimubur.pdfIn PDF document text
    • http://bagiez.com/userfiles/file/vavujumukafugexagulorune.pdfIn PDF document text
    • http://idolyokocho.com/js/ckfinder/userfiles/files/fuzobagafesil.pdfIn PDF document text
    • http://mariellatriolo.it/public/file/lalawaxufuworekemusupil.pdfIn PDF document text
    • http://tainghe.vn/userfiles/file/gefizofogarasafad.pdfIn PDF document text
    • http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/161452602e538e---rapifisizevanatobagoniz.pdfIn PDF document text
    • http://feedproxy.google.com/~r/Xvkpad/~3/UsNeCLCzgYg/uplcv?utm_term=political+science+optional+upsc+previous+year+question+papersPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b86b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB86B 17460 bytes
SHA-256: 64559635c6d492b412f68fd8328571f1d64eeed2c8e22493387f0d5794e4b371
font_01_sfnt_off0000e533.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE533 10796 bytes
SHA-256: 436b7c4184b8b17c5bb2e548fa01850db6d4413816e80fa3048fa207da8bbc99
font_02_sfnt_off0000fe3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE3F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.