Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f4d7c54343446bd…

MALICIOUS

PDF

78.3 KB Created: 2021-07-20 15:14:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-13
MD5: 77816df98370e62ace1db3f78532ddf5 SHA-1: 06e7497fb1c18694321128aa973921e477098dd6 SHA-256: 5f4d7c54343446bd2d89e8070833ab6db26994777220d0f896d18d66a5bdbce3
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and a significant number of external URIs, many of which point to compromised CMS uploads or disposable hosting, indicating a link farm designed for phishing or malware distribution. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or trojan delivery via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9949

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://longbienco.com/js/ckfinder/userfiles/files/fanefiwagebexepimivar.pdf In PDF document text
    • http://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160afdce54426e---dezanerumetakugusiduzadar.pdfIn PDF document text
    • https://marbellamohali.com/wp-content/plugins/super-forms/uploads/php/files/06b608f1a8bbc5a475a37f60b1b4d31b/38607098530.pdfIn PDF document text
    • https://dipinkrishna.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f5f29657e0a---vajebexiligekiziw.pdfIn PDF document text
    • http://www.nandomoraes.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160e4b4b9e7c43---70161239221.pdfIn PDF document text
    • https://psychotherapie-dr-albrecht.de/wp-content/plugins/formcraft/file-upload/server/content/files/16086c01a6eb63---kiwutebamugix.pdfIn PDF document text
    • http://www.jacenter.org/js/ckfinder/userfiles/files/todun.pdfIn PDF document text
    • https://www.corridar.com/wp-content/plugins/super-forms/uploads/php/files/mapbn10q94d8tr3lhhft616ku6/23382958452.pdfIn PDF document text
    • http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/d1k6507hcuk0qtu70p5475e2o0/tapizapukoxiwevutol.pdfIn PDF document text
    • https://militarynetwork.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608872ca1ed09---wukiforepiwajositepitovi.pdfIn PDF document text
    • http://constantcontinuity.com/membership/data//files/votimukuzubowawujodijen.pdfIn PDF document text
    • http://sl-light.ru/design/img/upload/file/bisedolirenuvowixi.pdfIn PDF document text
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c73788a8e99---mivavilutifutogadebasoki.pdfIn PDF document text
    • https://doublehair.center/upload/ckfinder/files/kategituzijujef.pdfIn PDF document text
    • http://anvlaw.com/userfiles/file/datagaxuxefupemekegazexer.pdfIn PDF document text
    • http://wabasnb.com/files/fckeditor/file/88978306760e63068d49ed.pdfIn PDF document text
    • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/u4d0rdq5ipp5obk7352c680pf6/44810661591.pdfIn PDF document text
    • http://amdind.com/userfiles/file/logusekojixiriwiz.pdfIn PDF document text
    • https://asiaviews.org/wp-content/plugins/super-forms/uploads/php/files/hkjfqpl8dq32rpr9m9ppb4r376/54531703468.pdfIn PDF document text
    • http://pensionpoint.cz/userfiles/files/70305561019.pdfIn PDF document text
    • http://ukrainski-rosyjski.pl/userfiles/file/xutebozulipapevuvefesu.pdfIn PDF document text
    • http://wakingbeauty.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a977b957524---fubukidaf.pdfIn PDF document text
    • https://formapolis.it/wp-content/plugins/super-forms/uploads/php/files/fb9f57d55361f564c123c38768d7c46b/74160609810.pdfIn PDF document text
    • https://www.beadvised.co.uk/wp-content/plugins/super-forms/uploads/php/files/cb07cfb2d8f604140c0ddc80e144989d/titiwimajawafekexuzod.pdfIn PDF document text
    • http://www.adatechotomasyon.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607ad9e02657f---87701834759.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/6naE_Nh8_CY/uplcv?utm_term=in+the+end+piano+notes+for+beginnersPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c5d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC5D0 10820 bytes
SHA-256: 874b459e4fff2e0e6f5c2261786ca65de41de523e32b5791be2ad7be0a46ea61
font_01_sfnt_off0000de3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE3F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000f651.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF651 20252 bytes
SHA-256: f21f05356e1cb0c45fe9db2db07cf13c584da179f03dd1f1cd9a5b5a1de28d22

Open this report in the interactive analyzer, or submit your own file for analysis.