Malicious PDF — malware analysis report

Static analysis result for SHA-256 5352e74b597314a0…

MALICIOUS

PDF

83.6 KB Created: 2021-09-01 21:53:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: abe870f4e7611996920bdb27b31167c5 SHA-1: 76b7eff81e7bb4785428c01cb344989a2d96bd8f SHA-256: 5352e74b597314a0b7c50c0ffa47c4bde4572142feae93bedf6ae638ab7432eb
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF containing embedded JavaScript, which is a common technique for executing malicious code. It also hosts a large number of URLs, many pointing to compromised CMS upload directories, indicating a link farm designed to redirect users to potentially malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=the+secret+world+leveling+guide PDF link annotation
    • http://veraschwemmle.de/fckdata/file/vowogizudobotumabogojotu.pdfIn PDF document text
    • http://allycatering.com/userfiles/54350887732.pdfIn PDF document text
    • https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/9c6982d3b3f6b8b599148c2b053bb868/morujavonu.pdfIn PDF document text
    • https://www.lavishlook.se/wp-content/plugins/super-forms/uploads/php/files/d3a16d7d3d44eb2388de98cb04144ca6/1932252742.pdfIn PDF document text
    • https://lightupalife.org.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160b64e458343b---99061802744.pdfIn PDF document text
    • https://paeonia.ch/userfiles/files/69232465300.pdfIn PDF document text
    • http://exmar.it/foto_fck/file/niwaxeredisosu.pdfIn PDF document text
    • http://timebank.ru/sites/default/files/photos/pagefile/29331400377.pdfIn PDF document text
    • http://adacu.org/userfiles/file/20210716060406.pdfIn PDF document text
    • http://benetworkingpro.com/ckfinder/userfiles/files/40932573489.pdfIn PDF document text
    • http://mamolenasnc.it/userfiles/files/98132049690.pdfIn PDF document text
    • http://shuswapladystriders.ca/userfiles/file/78427034116.pdfIn PDF document text
    • https://universitecentrale.net/uploads/FCK_files/file/bonusafeseda.pdfIn PDF document text
    • http://alisawedding.com/upload/users/files/16407939235.pdfIn PDF document text
    • http://4bx.pl/public/file/finuti.pdfIn PDF document text
    • https://prikolnaya.com/wp-content/plugins/super-forms/uploads/php/files/9a9dc3c9237c3c5b2064a58b94435335/vepovaligusoj.pdfIn PDF document text
    • http://localhomesales.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1606fb7f6a540f---35290614594.pdfIn PDF document text
    • https://lemanssrl.it/file/dujomidosagisut.pdfIn PDF document text
    • http://riversedgefm.com/files/file/18822851233.pdfIn PDF document text
    • https://www.santaterezinha.com.br/js/ckfinder/userfiles/files/37154401718.pdfIn PDF document text
    • https://www.mixedclass.com.au/wp-content/plugins/super-forms/uploads/php/files/qtabhnh5taruigra514jebf329/98186225909.pdfIn PDF document text
    • https://bxthirteen.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/b8e542416895585e1266eed19a79b5b5/bovanug.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e187.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE187 10704 bytes
SHA-256: b2aca4cdf4f109e2272b6fb1989a1f33fceccf70d370dc0a315760f4cae3826c
font_01_sfnt_off0000f9ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9EA 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000111fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111FC 17784 bytes
SHA-256: 2f7f86fd8e315fbf85b4c7d4e33a8b54d7c22118f31d8c0f1daaeb58a7ad7698

Open this report in the interactive analyzer, or submit your own file for analysis.