Malicious PDF — malware analysis report

Static analysis result for SHA-256 5641103716858098…

MALICIOUS

PDF

93.9 KB Created: 2021-07-13 16:49:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: 86846351dc0a456617cd8d9fe3e9b61d SHA-1: 8f4c541d40243546058a89ee90e0563d4d7d8b9d SHA-256: 5641103716858098a3c5a9a109f53fd3f30a44e360f0a6f3e1259bcceeb32494
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The document contains numerous links, many pointing to compromised WordPress sites, suggesting it functions as a link farm to distribute malicious content or phish users. No scripts were extracted, but the presence of external URIs and the link farm structure indicates a clear intent to redirect users to potentially harmful destinations.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9918

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/uplcv?utm_term=our+fear+of+immigrants+summary PDF link annotation
    • https://bizdrive.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160b7a493c1d7e---rofas.pdfIn PDF document text
    • https://maloneslandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609429230e051---zuxowenopefa.pdfIn PDF document text
    • http://www.itbaloch.com/wp-content/plugins/formcraft/file-upload/server/content/files/16092b3251be5c---fodafidofenamefosanakitu.pdfIn PDF document text
    • http://quaint-house.com/zupepumijija.pdfIn PDF document text
    • http://erfaspot.com/resimler/files/36184871362.pdfIn PDF document text
    • https://minutesnap.com/wp-content/plugins/super-forms/uploads/php/files/e6cc9a6bfba5f43c7d24c3471178a521/28013785951.pdfIn PDF document text
    • http://3lbordercollies.com/clients/a/a5/a537dd6ebb785c9f51a9b4acbfea693c/File/dejulo.pdfIn PDF document text
    • https://www.hit-education.com/wp-content/plugins/super-forms/uploads/php/files/ke178b8jq59jbojqdl7olt9dfe/zekalenunosexigaralutovu.pdfIn PDF document text
    • https://www.azulejositurry.com/wp-content/plugins/super-forms/uploads/php/files/0i2rr3nfpajgt2ko11b0fpem61/dadazanokogabenez.pdfIn PDF document text
    • http://shmountaineering.co.uk/wp-content/plugins/super-forms/uploads/php/files/26idev8tibri6vs4t5d624gfk3/sepuleposunetabe.pdfIn PDF document text
    • https://anzmrrn.org/wp-content/plugins/formcraft/file-upload/server/content/files/16095042b2bff4---wunutosobeguvu.pdfIn PDF document text
    • http://casaatlantida.com/userfiles/file///44315695798.pdfIn PDF document text
    • https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16082d2123bd0a---31848078200.pdfIn PDF document text
    • http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6eaf6af369---xevilujorakevoxuvuvozorex.pdfIn PDF document text
    • http://julieesteban.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a9d558f8e0---gajeradabetarazegevawegi.pdfIn PDF document text
    • https://www.dolphinrfid.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c399113e87a---87325123818.pdfIn PDF document text
    • http://beloezoloto.ru/userfiles/file/televutudajo.pdfIn PDF document text
    • https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b7698c26cb1---86228129401.pdfIn PDF document text
    • https://militarynetwork.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609b838063c36---1443777226.pdfIn PDF document text
    • https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160929d63e024b---64128759457.pdfIn PDF document text
    • https://bd-sokolovska.eu/userfiles/file/86978025800.pdfIn PDF document text
    • http://oneself.pro/wp-content/plugins/formcraft/file-upload/server/content/files/1609795412cfd6---norosawasekefiliwit.pdfIn PDF document text
    • https://www.bouldersudbury.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609ca9fde4c75---25928506385.pdfIn PDF document text
    • https://glosunspa.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cabf205d10c---81337187967.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0EE 10752 bytes
SHA-256: eadaa796ad865975e9ec877814c494153e88eb7b43a2de81714669d8e55a2db5
font_01_sfnt_off000109bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109BD 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000121ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121CE 17032 bytes
SHA-256: bd9b9a8884b1d159bc669e6650b6503af740944779cffb59759b22390c855d1e
font_03_sfnt_off00013aeb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13AEB 17456 bytes
SHA-256: 5b7be7850eb2b5004765b1308bcd395cdffd329a7329f5d83509eac89bcee2cb

Open this report in the interactive analyzer, or submit your own file for analysis.