Malicious PDF — malware analysis report

Static analysis result for SHA-256 57469b27ad2ceb15…

MALICIOUS

PDF

81.6 KB Created: 2021-09-03 12:58:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 14c1874cbb0d62d3ec406203818357d6 SHA-1: 621bed4f9f3d64bfbf707addafde532d3c063bc6 SHA-256: 57469b27ad2ceb156205d1fe9a9aa86da3a161b8ff720111b5cd8fafdaf56a7e
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external websites, many of which appear to be compromised or disposable hosting, suggesting a link farm designed to redirect users. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely instructs the user to open a password-protected archive, a common tactic to bypass gateway security. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9911

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/uplcv?utm_term=convert+pdf+to+word+baixaki PDF link annotation
    • http://www.impactit.in/ckfinder/userfiles/files/69525079854.pdfIn PDF document text
    • https://realestateconnect.us/wp-content/plugins/super-forms/uploads/php/files/d1jq6lbggud88n2hroqc1oum54/xemivagejovab.pdfIn PDF document text
    • https://aspirecambodia-edu.org/userfiles/file/89950642817.pdfIn PDF document text
    • https://associazionedynamica.it/uploads/file/78963829938.pdfIn PDF document text
    • https://www.mercato.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16072c5e9b4d94---bigefefogizimejisixigo.pdfIn PDF document text
    • http://spakimthi.com/upload/files/16140471901.pdfIn PDF document text
    • http://benrassam.com/uploads/files/90690347439.pdfIn PDF document text
    • http://www.supercarrentalsofmiami.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609a7830e1aff---foburosulegawujade.pdfIn PDF document text
    • http://tatugigo.com/ckfinder/userfiles/files/52446249289.pdfIn PDF document text
    • http://www.afamaresme.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c1552143235---50690945016.pdfIn PDF document text
    • http://www.magicapro.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607f7b697cfe4---84638654033.pdfIn PDF document text
    • http://hatowo.com/app/webroot/uploads/files/68372142501.pdfIn PDF document text
    • https://www.jscorporation.co.in/wp-content/plugins/formcraft/file-upload/server/content/files/1609b8a8d07d54---xiporupurikunizitepomi.pdfIn PDF document text
    • https://lukili.ch/UserFiles/files/45443833469.pdfIn PDF document text
    • http://stkvn.ru/wp-content/plugins/super-forms/uploads/php/files/8ed7b450741c26068e34bc6e55ff2e77/31563029607.pdfIn PDF document text
    • https://accuratesearch.com/userfiles/file/movasugej.pdfIn PDF document text
    • http://musorcentrum.hu/files/article/file/melipuwuvelirow.pdfIn PDF document text
    • https://www.entornopublicitario.com/wp-content/plugins/super-forms/uploads/php/files/cb6ae50e6f61c7cc8a6d10912f7f57fa/94389264777.pdfIn PDF document text
    • https://www.taxikladis.gr/wp-content/plugins/formcraft/file-upload/server/content/files/16072ec724a79c---95869563667.pdfIn PDF document text
    • https://www.urban-quartz.co.uk/wp-content/plugins/super-forms/uploads/php/files/cb5ad1d542843a65879b1fa4a3760f57/8516666862.pdfIn PDF document text
    • https://chandrakantmusicacademy.org/ckfinder/userfiles/files/migenob.pdfIn PDF document text
    • http://alsumiri.net/wp-content/plugins/super-forms/uploads/php/files/1c587473b712141ca1b3e6c31d408b07/saribobonunulex.pdfIn PDF document text
    • https://weblative.com/wp-content/plugins/super-forms/uploads/php/files/jk42egt593afr74hovr51795l3/wedufipupapojodugiketil.pdfIn PDF document text
    • https://stakeoutllc.com/wp-content/plugins/super-forms/uploads/php/files/632d74df03eea8d54c5c1276bf4d5644/39465046677.pdfIn PDF document text
    • https://tkquiz.com/userfiles/file/dazudesajas.pdfIn PDF document text
    • https://lakecountyoralsurgery.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086028fc89f2---bobivonuxemodonazaxi.pdfIn PDF document text
    • http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608be7e242b3b---28193509524.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d696.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD696 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000eead.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEAD 10796 bytes
SHA-256: 9f85847caaad0c3da45d5628a60ccc3db49726e64b7470476fc60e8bfe812021
font_02_sfnt_off00010787.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10787 18824 bytes
SHA-256: cf83a3b31252a710b691b9ba4f1e49044b79c9bd358b1c0d1a8ef8057d5ffe9e

Open this report in the interactive analyzer, or submit your own file for analysis.