Malicious PDF — malware analysis report

Static analysis result for SHA-256 5cc1284df702fa6c…

MALICIOUS

PDF

76.9 KB Created: 2021-06-18 03:50:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: bfad678af256b6299eea62322156d2eb SHA-1: 15730945ebcdcdf10a61fd414cd1f1dd8d776f98 SHA-256: 5cc1284df702fa6c646fe91eac666f8cbb511fc1d7bb0b636b403020e7eb8582
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by ML classifiers and ClamAV, exhibiting characteristics of a phishing and link farm distribution. It contains numerous URLs pointing to compromised websites and disposable hosting, masquerading as a Vidmate APK download. The presence of embedded URLs and the overall structure suggest an attempt to redirect users to malicious content or downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=vidmate+apk+download+old+version+2017 PDF link annotation
    • https://atraba-holding.com/userfiles/file/91847699284.pdfIn PDF document text
    • https://www.bouldersudbury.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c930a909a69---wakeb.pdfIn PDF document text
    • https://www.sussexweddingservices.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160ae42d837991---luxozusikew.pdfIn PDF document text
    • http://mobilephleb.com/clients/2/2d/2d2188d13063160162e6e2bbcdac547d/File/140557947.pdfIn PDF document text
    • http://thanhlamresort.vn/wp-content/plugins/formcraft/file-upload/server/content/files/160a34cb5b422b---9898932442.pdfIn PDF document text
    • https://newat.ru/wp-content/plugins/super-forms/uploads/php/files/bb85af4db78b3941b02b20bb4285d261/vonufazivi.pdfIn PDF document text
    • http://alpha-cp.com/userfiles/file/79724758529.pdfIn PDF document text
    • https://erinmillssmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/muh24jk5pjdjvju9oquf6dd9a2/rutegodosegijewolotesu.pdfIn PDF document text
    • http://www.gonouvellezelande.com/files/10520275713.pdfIn PDF document text
    • http://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160757c2b22741---40983981127.pdfIn PDF document text
    • http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160aa359352b57---97611268429.pdfIn PDF document text
    • https://www.qlsny.com/wp-content/plugins/super-forms/uploads/php/files/f0eaa7d0636248e2e63592b64c0a9858/pidomeri.pdfIn PDF document text
    • http://www.hollyskauaicondo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607248bf67615---35373162798.pdfIn PDF document text
    • https://veritiesinstitute.com/wp-content/plugins/super-forms/uploads/php/files/542cd3805b39149bd73b31d2e35783bb/dugutudararipegejor.pdfIn PDF document text
    • https://earplighting.com/wp-content/plugins/super-forms/uploads/php/files/0903a906b580110c9c34313b29fab6f8/wikujogeda.pdfIn PDF document text
    • http://www.theagentpipeline.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c664923e8c2---95580952756.pdfIn PDF document text
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160743c6a3bef4---fijunurujuxikowevisiviz.pdfIn PDF document text
    • http://yuha.be/_files/file/52062502297.pdfIn PDF document text
    • http://syuncyoku.jp/upload/file/wogowawosoteperenatimuzax.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e416.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE416 5692 bytes
SHA-256: cfcf1c77dce3f52803144f4fd1352527fabfe3557b16b5d768af7f1c8f050f43
font_01_sfnt_off0000f782.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF782 2116 bytes
SHA-256: c0b080a3303b8e939d585112c399c02879d5f0d732e84daf845a916286948345
font_02_sfnt_off0001012e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1012E 10828 bytes
SHA-256: bd6fc9ffa46332dc2d5f3fab7fd7562080b01c93fe90d5f46a608954795a6bd3

Open this report in the interactive analyzer, or submit your own file for analysis.