Malicious PDF — malware analysis report

Static analysis result for SHA-256 5411408161605a14…

MALICIOUS

PDF

84.7 KB Created: 2021-07-03 17:12:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23
MD5: 8821d29577a9e9d071e2e4e451da2696 SHA-1: 18d3376dd800063afbed43b22aa65a3c742bfbc2 SHA-256: 5411408161605a148da86e584f9682b329e9d85a6bbcbad8bb2ba920b7924f95
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous links pointing to compromised WordPress sites and other disposable hosting, forming a link farm. The primary purpose appears to be directing users to malicious content, likely for phishing or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://allytemp.ru/uplcv?utm_term=praise+and+worship+songs+african PDF link annotation
    • https://boldvision.tv/wp-content/plugins/formcraft/file-upload/server/content/files/1609e473c4654c---3108500332.pdfIn PDF document text
    • http://compie.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160b2d07825efb---96723269889.pdfIn PDF document text
    • https://www.davinci.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160c4031799276---50610455934.pdfIn PDF document text
    • https://teplitsyoptom.ru/wp-content/plugins/super-forms/uploads/php/files/a1f2aa7eccf300fd50a87cd7768e4081/2323518304.pdfIn PDF document text
    • http://targhevaticane.it/userfiles/files/11845140545.pdfIn PDF document text
    • http://msslink.ru/userfiles/files/diwajuzuzejesom.pdfIn PDF document text
    • https://www.rockandroll.blog.br/wp-content/plugins/super-forms/uploads/php/files/pj1ruj08j3prj94jauahpi5i2b/xikonefezusasiwi.pdfIn PDF document text
    • https://pluviaterra.mx/wp-content/plugins/super-forms/uploads/php/files/c7ef9e15d770b4baa4539e321c68e1c0/pakitodusidajiz.pdfIn PDF document text
    • https://makemycake.gr/wp-content/plugins/super-forms/uploads/php/files/11fiev27i0k3vuv234akma94j9/16302863584.pdfIn PDF document text
    • https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/eccb018873367892be6f181d9bc7bddc/wuvusenagorotapisijopoj.pdfIn PDF document text
    • http://www.korayozelguvenlik.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089549c8c44d---vevimuvitu.pdfIn PDF document text
    • http://bilagroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075c49488b0f---zadadipo.pdfIn PDF document text
    • http://www.dadosefatos.net.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a261b16a663---mujizabikemarefuwez.pdfIn PDF document text
    • http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a8110c825bf---99319923841.pdfIn PDF document text
    • https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/bdd0bb001beec0c4ee98e3e08d574959/bomagux.pdfIn PDF document text
    • http://loadcell.vn/Images_upload/files/90684452191.pdfIn PDF document text
    • http://remontnoedelo.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1609483dc128d7---rixaduvunotovawatudurax.pdfIn PDF document text
    • https://interior-mark.com/ckfinder/userfiles/files/piwuxowabevegun.pdfIn PDF document text
    • https://uleshuzataruhaz.hu/files/file/92228824613.pdfIn PDF document text
    • http://odpadykj.cz/UserFiles/File/92971303180.pdfIn PDF document text
    • http://abimobiliare.pl/pliki/File/kumiponezuwanabipobikoke.pdfIn PDF document text
    • https://thefertilizerequipment.com/d/files/35553398527.pdfIn PDF document text
    • http://www.icodar.com/wp-content/plugins/formcraft/file-upload/server/content/files/160872af242430---85022792989.pdfIn PDF document text
    • http://muszempilla.com/files/file/gosozanuvatadokivore.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e628.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE628 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000fe3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE3A 17784 bytes
SHA-256: 7253e6e063d3bc439bbe60ef2b8d3658547871e91f465f6bb4104ef98e68caa1
font_02_sfnt_off00012ce4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CE4 10840 bytes
SHA-256: 0562e79de007784045caf1e9661d5ae2b4239a42d940041b650aef1c3ddc0bef

Open this report in the interactive analyzer, or submit your own file for analysis.