Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fe230df86df6480…

MALICIOUS

PDF

114.4 KB Created: 2021-06-26 16:29:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: 3e26d2b6caf5d6171e0647600dcf3669 SHA-1: a8518de9a7af93d20276e238adc3173c47565341 SHA-256: 5fe230df86df6480fa0fe44b4c959a25a3e7d8d1e4edcd6462b66879dc916c3d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document contains a link farm with numerous URLs hosted on compromised WordPress sites, suggesting an attempt to redirect users to malicious content. The presence of these links and the overall structure indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9871

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://rmdschoolandcollege.com/wp-content/plugins/super-forms/uploads/php/files/gioc28uui478t8gu8h7c8vqqg7/14531434686.pdf In PDF document text
    • http://www.iso-clean.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16098a468811a2---26161959144.pdfIn PDF document text
    • http://www.tecnotrefg.it/wp-content/plugins/formcraft/file-upload/server/content/files/16090363ae173a---rurovesinoteturamusopis.pdfIn PDF document text
    • https://voicelux.ru/wp-content/plugins/super-forms/uploads/php/files/e52711b50df786ffa7102170495727de/80602556928.pdfIn PDF document text
    • https://amerismithenterprises.com/wp-content/plugins/super-forms/uploads/php/files/1b0a2d5bb951cc257b32d5eede40e286/82032180249.pdfIn PDF document text
    • https://pensionatiitalianiinportogallo.it/wp-content/plugins/super-forms/uploads/php/files/0cafd6408b598f8f5a07d4bbf216e354/60286861739.pdfIn PDF document text
    • https://www.ideaklinikbakirkoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a48229f264c---43565754396.pdfIn PDF document text
    • https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160d69c2a68181---sejudewukabujifego.pdfIn PDF document text
    • https://clubelsendero.com/img_pag/file/53350862244.pdfIn PDF document text
    • https://www.mobytec.com.br/mobytec/wp-content/plugins/formcraft/file-upload/server/content/files/1608ebf6329c1f---70262712846.pdfIn PDF document text
    • https://gresathouse.com/wp-content/plugins/super-forms/uploads/php/files/f78c5fab6858b1dd697df293d24cd450/madafikusifazijened.pdfIn PDF document text
    • http://hillcresthigh1971.com/clients/9/9f/9fbf9047a6869172a982db6f42f05a9a/File/83375184187.pdfIn PDF document text
    • https://webgirls-studio.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c9b2fa5d043---77006027980.pdfIn PDF document text
    • http://globalquestconsulting.com/userfiles/files/luporuvufa.pdfIn PDF document text
    • https://rodolphe-blanchet.fr/Rodolphe/fckeditor/file/muzoxokesiwipav.pdfIn PDF document text
    • https://clifestyle.net/uploades/userfiles/file/73422169562.pdfIn PDF document text
    • http://for-rent-leuven.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1a078e1dc2---dafipaludazesuduxobaveve.pdfIn PDF document text
    • https://www.burit.net/wp-content/plugins/formcraft/file-upload/server/content/files/16082043f39e01---filakura.pdfIn PDF document text
    • https://www.blackandwhite-salon.com/wp-content/plugins/super-forms/uploads/php/files/9b99c3d5c5877b0b2bb886b7f7cf2cd9/84099617628.pdfIn PDF document text
    • https://beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/3f0c6b16686729ab4d1dfa6db0008e40/83905202309.pdfIn PDF document text
    • http://texmet.pl/userimages/file/wijevojijawepifiv.pdfIn PDF document text
    • http://phuquytravel.com/nguyenvanlinh/files/zatenisajizotonegidipu.pdfIn PDF document text
    • https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094920d980a6---forobevuxawi.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f0eadc8943---manalebafogozowapixag.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=great+pyrenees+mastiff+mix+puppiesPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014363.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14363 16520 bytes
SHA-256: 17dab69886bbd3ec2a6b7f0b1d65c3601f0d4afd9e3fe3dca6a26fc3206f9cfe
font_01_sfnt_off000159e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x159E7 10708 bytes
SHA-256: a0dfd7b70c31a4b03b7d957c667840df72e794fa5041b5b9b86aee18b9ccb850
font_02_sfnt_off00017293.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17293 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00018aa5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18AA5 18564 bytes
SHA-256: d51553936a438e7e3c4c7a194a1a4352ffb437da4e327eeec260a6ea75be5001

Open this report in the interactive analyzer, or submit your own file for analysis.