Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c08c3dfaaedd62a…

MALICIOUS

PDF

74.9 KB Created: 2021-09-15 12:32:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: c71e3376a45ff5d2d422c2a84165a2e0 SHA-1: 546616d85624fa3e61ae9d4072711efeae7cece0 SHA-256: 5c08c3dfaaedd62ad9173b4340176d418f94bfda3beea804747a6820e70ac80c
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious by ML classifiers and ClamAV, specifically as a PDF phishing trojan. It contains numerous embedded URLs, many pointing to compromised CMS uploads, suggesting an attempt to host or distribute malicious content. The presence of a 'download button' heuristic further supports a lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=schaum%27s+outline+fourier+analysis+pdf PDF link annotation
    • http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/16139842c631ad---zaxaraze.pdfIn PDF document text
    • http://praguynakorn.com/praguynakorn/picture/datapro/files/59562257572.pdfIn PDF document text
    • http://www.tomasjelinek.com/img/pub/file/wosasejaxovojov.pdfIn PDF document text
    • http://tindangnhadat.vn/upload/files/77307099074.pdfIn PDF document text
    • https://hyosung-gulf.com/uploads/file/tovaxomusixufuvokek.pdfIn PDF document text
    • http://hattrick-sports.com/wp-content/plugins/formcraft/file-upload/server/content/files/161377beb1a6b9---89469695884.pdfIn PDF document text
    • https://cristiandellavedova.com/wp-content/plugins/super-forms/uploads/php/files/c3413277ad841673908e0fde7a4e7a8f/pawovaw.pdfIn PDF document text
    • http://gugugroup.com/userfiles/xasafogivadetalipizuraz.pdfIn PDF document text
    • https://alpinashop.rudy-ra.com/files/sazafusilanufenajune.pdfIn PDF document text
    • http://checopharma.com/upload/files/vomet.pdfIn PDF document text
    • http://www.sunarsurdurulebilir.com/wp-content/plugins/super-forms/uploads/php/files/vhj6m04t6e20ehijbogq39id32/78448063579.pdfIn PDF document text
    • http://orthodoxnews.us/file/bufewovepovanigunur.pdfIn PDF document text
    • http://musicincw.com/fckeditor/userfiles/image/51200256812.pdfIn PDF document text
    • http://rivebistro.net/ckfinder/userfiles/files/vitijesudujaten.pdfIn PDF document text
    • http://giaexploring.it/userfiles/files/fibirajax.pdfIn PDF document text
    • https://protrialse.eu/files/files/palelabigujelopujevogore.pdfIn PDF document text
    • https://faresaldabbous.com/uploads/file/51924490238.pdfIn PDF document text
    • https://thehouseconcert.com/ckfinder/userfiles/files/wazezulunowopas.pdfIn PDF document text
    • http://digitalpolicycouncil.org/imagenes/file/wudepu.pdfIn PDF document text
    • http://ydchem.cn/filespath/files/20210915142913.pdfIn PDF document text
    • https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/e2a18cf55e676cc253ff3ca97c2d77c8/dupebub.pdfIn PDF document text
    • http://kokocurry.gm/userfiles/file/tuzema.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c03d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC03D 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000d854.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD854 11208 bytes
SHA-256: 263e306c25e0d0b61cd0027a21ae3818c14bb0b9f2a54716cfa442ce69dda03e
font_02_sfnt_off0000f270.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF270 16800 bytes
SHA-256: 72a42174be3fd4363345605eb0a095995671a96242e66ec3a5cfd54c7b52a0ad

Open this report in the interactive analyzer, or submit your own file for analysis.