Malicious PDF — malware analysis report

Static analysis result for SHA-256 645f1f08b3937ba4…

MALICIOUS

PDF

104.8 KB Created: 2021-06-25 18:48:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: bb97fad77f67d862a9b96fe8368e38e8 SHA-1: babf2f8337f8be50d3a82e23694a8b5478eac7d0 SHA-256: 645f1f08b3937ba40b1d5db65b0eda89c83a66aed2dcf67823ec7b69e9d13718
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous URLs pointing to compromised CMS upload storage and disposable hosting, suggesting a link farm designed to redirect users to malicious content. The PDF structure and embedded URLs are consistent with a phishing lure or a downloader for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9358

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=the+conjuring+full+movie+telugu PDF link annotation
    • https://humble-brag.com/wp-content/plugins/super-forms/uploads/php/files/j72f2qh1u85atmt71mhi1tiio9/82488563640.pdfIn PDF document text
    • http://unipsyclinic.com/userfiles/file/20210517060343.pdfIn PDF document text
    • https://yourtuscanyguide.com/wp-content/plugins/super-forms/uploads/php/files/3b60iqufp7emfesvt1t2haoap1/23440611384.pdfIn PDF document text
    • https://travelselection.us/wp-content/plugins/formcraft/file-upload/server/content/files/160a3e929683e6---xijodufosomamu.pdfIn PDF document text
    • http://www.stallionreadymix.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16093c01c53d7f---loruwifejujafikopex.pdfIn PDF document text
    • http://cityhighclassof77.com/clients/9/9e/9ea685038b5a197d2022a69b8c6b162a/File/rosizidujaxikuwu.pdfIn PDF document text
    • http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac1da1aedd2---98109433919.pdfIn PDF document text
    • https://xosobacninh.vn/webroot/img/files/taxumavezinolewekuxuved.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160884d7b5d868---futikutodel.pdfIn PDF document text
    • http://3handseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aa91058ad05---fimokafapefolilodoxu.pdfIn PDF document text
    • http://slippersymposium.com/clients/875641/File/24797168190.pdfIn PDF document text
    • https://www.frankcapassoandsons.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608532ef24d92---pubupek.pdfIn PDF document text
    • https://toolsatool.com/userfiles/files/69642906186.pdfIn PDF document text
    • https://neoville.ru/wp-content/plugins/super-forms/uploads/php/files/c171bf27b05b2962382e13ce8a4c425c/46619982523.pdfIn PDF document text
    • https://almondzwealth.com/administrator/imagetemp/file/tokawajebupamokonas.pdfIn PDF document text
    • http://xn--o39a91gvwm83kbsn.com/FileData/ckfinder/files/20210620_F5BD985B92E3ADEA.pdfIn PDF document text
    • http://www.yoko-ono.be/images/userfiles/file/9029698014.pdfIn PDF document text
    • http://topopentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aa8f2e00b4b---rijajosapekasumo.pdfIn PDF document text
    • http://constructionone.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160702388edd58---70758310705.pdfIn PDF document text
    • https://www.euroservicemilano.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609d4a10891f2---55498779124.pdfIn PDF document text
    • http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1608428f97ff70---zoxexe.pdfIn PDF document text
    • https://kindliving.org/wp-content/plugins/super-forms/uploads/php/files/tmp/wisujibulugireriwuduxo.pdfIn PDF document text
    • https://www.pietri-automobiles.com/wp-content/plugins/super-forms/uploads/php/files/293g9ls16ri9d9enib61t2h7fd/55612954116.pdfIn PDF document text
    • https://www.lorenzofranzone.it/wp-content/plugins/super-forms/uploads/php/files/486f6d397d0c72eb54aed2cf5f9972cb/mamuvotaketove.pdfIn PDF document text
    • https://tmtteks.com/files/zalabopula.pdfIn PDF document text
    • https://www.msolartop.cz/wp-content/plugins/formcraft/file-upload/server/content/files/1609a484dac34d---17116849399.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011254.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11254 1784 bytes
SHA-256: e56bba586f25b7bb331306cce9154593ee2e022724dfd3cbe2c17502343e7eeb
font_01_sfnt_off00011ab9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11AB9 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000132cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x132CB 18660 bytes
SHA-256: c8d80bc2d19ff40d1f9fdee9ea7a6e1abc0ffc54b783ab05889f0dd990ef8ce9
font_03_sfnt_off000163c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x163C2 16420 bytes
SHA-256: 09a2298e92f7be3d1503157ef6ef650cf0cb0f8c6dd906c6c819c835f73b47c3
font_04_sfnt_off00017a7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17A7D 10712 bytes
SHA-256: 104a4cf92800769f248c1c9caf7545a9ce1c92ae55c833002c02a26cb9fc8214

Open this report in the interactive analyzer, or submit your own file for analysis.