Malicious PDF — malware analysis report

Static analysis result for SHA-256 52b413398619b502…

MALICIOUS

PDF

95.4 KB Created: 2021-07-04 12:27:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 408896f7a127f0d0521f53dbf4164022 SHA-1: f07ec7d665ae315e053e64d3ee1e6d3a40d698de SHA-256: 52b413398619b5020e80a2e117dbb2cea30d579293d158908833f5caeca5911a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous links pointing to compromised WordPress sites and disposable hosting, suggesting it functions as a link farm to redirect users to malicious content. The presence of embedded URLs and the nature of the heuristics strongly suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9806

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.erenang.com/wp-content/plugins/formcraft/file-upload/server/content/files/160862fedc02d1---galupad.pdf
    • http://vudafrique.com/wp-content/plugins/super-forms/uploads/php/files/14e450d3dff2445b2a867ef3bed6dfd9/marowivafaperowabewobu.pdf
    • http://robwalker.net/fckupload/file/resarutiga.pdf
    • http://www.absolutecateringla.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e04253a5a2e---19896151669.pdf
    • http://smartmedicaleg.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfa054048ec---bipapefavajegax.pdf
    • http://berbun.com/user_img/file/16306275262.pdf
    • http://thingsantiquesla.com/userfiles/files/solazusugutali.pdf
    • http://abwcrainhwy.com/uploads/files/zadapufenolasofiralazivof.pdf
    • https://www.golddustdental.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095000c743de---vigiw.pdf
    • https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/23ab970d560bc96668fa10a73b25b055/58328930238.pdf
    • http://cbelmira.com/wp-content/plugins/super-forms/uploads/php/files/49k7757i244v5kq99tgiqkkm84/69160922445.pdf
    • http://vtracauto.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609f8e1be9726---37672751911.pdf
    • http://julieesteban.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c73f8e8b3d5---xuwuzanazosutaxukisi.pdf
    • http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/16073e469d983d---20346936679.pdf
    • http://banglatalkies.com/dynamic-images/cms/file/wafukitawopu.pdf
    • http://smartarts.bg/userfiles/file/89338030248.pdf
    • http://hugslock.com/app/webroot/img/files/40278131309.pdf
    • http://brighterhealthcare.co.uk/wp-content/plugins/super-forms/uploads/php/files/ceb4094r55i7ieve8b692p8voj/farivosavopajomewiwugo.pdf
    • https://getlovebooks.com/wp-content/plugins/super-forms/uploads/php/files/422a9215730a7d2e72d19d6662eabff8/zefil.pdf
    • https://studio45.live/wp-content/plugins/super-forms/uploads/php/files/f4g6h9ib1c6h07m4h0i9ls3ldn/wiradedaserobiwasaxorukim.pdf
    • http://www.mearesandassociatesllc.com/siteuploads/editorimg/file/tibegek.pdf
    • https://www.saltriot.com/wp-content/plugins/super-forms/uploads/php/files/9d4d06be8369bd098da0ba0e7d42cfc5/vugazusajuk.pdf
    • http://weifong.tw/fckimages/file/tavinofamivozalo.pdf
    • https://cuisinescartier.ca/upload/editor/file/91785165988.pdf
    • https://mymango.ru/wp-content/plugins/super-forms/uploads/php/files/461bd34ebf6125abf12924b83efe3091/kixoviwizurexomugisutovot.pdf
    • http://objetivovender.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607dee9366e12---zefikuv.pdf
    • http://fresh-j.info/images/uploadedimages/file/59533610985.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=songs+with+e+minor
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001117d.bin
e55c2163bfc30cd79603a685564f41d6c2b93e8140e0a4e2193de16c328345d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1117D 18508 bytes
font_01_sfnt_off000140a2.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x140A2 16792 bytes
font_02_sfnt_off000158b9.bin
0daa629b01191624506d626d4837f0ab1186f7f6849cd147c9dc42c8e2eeabbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x158B9 10508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.