Malicious PDF — malware analysis report

Static analysis result for SHA-256 6585ad544e591303…

MALICIOUS

PDF

78.5 KB Created: 2021-06-28 19:55:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: b72bbf5db22aab7841a185adcb75af4a SHA-1: e8865e6cb7253e5ff09c02b8f956ea8c722b62fe SHA-256: 6585ad544e59130342a11a07a63a8baf413cb57060d1bdd6a3c417965637fe18
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It functions as a link farm, directing users to numerous external URLs, many of which are hosted on compromised WordPress sites. The presence of a 'download button' lure suggests an attempt to trick users into clicking these links, potentially leading to further compromise or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9949

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=bloons+td+5+trainer PDF link annotation
    • https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608244a23b864---kinorekome.pdfIn PDF document text
    • https://skyfireconsulting.com/wp-content/plugins/super-forms/uploads/php/files/o150cuide2r1bgrsm5l098nnkf/jadoges.pdfIn PDF document text
    • https://ferado.vn/userfiles/file/96197516250.pdfIn PDF document text
    • https://insights3.com/wp-content/plugins/super-forms/uploads/php/files/abda7fd3423020a43780ea8275e471e2/68497528695.pdfIn PDF document text
    • https://rubin2000-distribuitorshop.ro/userfiles/file/palorowizogabutekokim.pdfIn PDF document text
    • http://www.training4thefuture.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160a0619f1799a---jilukagem.pdfIn PDF document text
    • https://lakeshoresmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/8hont6ab1dcimg1f1dgdb16qm5/53632869886.pdfIn PDF document text
    • https://thepetrichortouch.com/wp-content/plugins/super-forms/uploads/php/files/bo6685k2g467ak0l08i6bkg1lj/80615922791.pdfIn PDF document text
    • http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160a943c86b476---tubewalugini.pdfIn PDF document text
    • http://xn--12cm8caae5d9a0a0a1dxk6dd.com/user_img/files/57731727336.pdfIn PDF document text
    • https://www.sesc.com.ua/wp-content/plugins/super-forms/uploads/php/files/g13edpjb8ef88tb90u420oift1/juvuwezuzubetogegomuju.pdfIn PDF document text
    • https://izharfoster.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c771d494ca1---sepezivotajutexamamij.pdfIn PDF document text
    • http://schooldistrictservices.com/clients/f/f6/f6ab1571d2cdf5e569af7b76e288b17c/File/vawovavujotiwebenali.pdfIn PDF document text
    • http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/160773182e2671---sivevarofunosuzazuxi.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac471146ce4---zadigisigas.pdfIn PDF document text
    • https://plumcourse.com/wp-content/plugins/super-forms/uploads/php/files/670b09f37cdfc00668a5956bfbc43946/rerupapigetox.pdfIn PDF document text
    • https://rffsev.ru/wp-content/plugins/super-forms/uploads/php/files/805238eda85ee8f4778732564e85b2f9/nixoviziganagajifibisuzu.pdfIn PDF document text
    • https://sirikulsteel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608476981901d---delavezukonoxil.pdfIn PDF document text
    • http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/5fj317ku6q8l7alldfkhcjcusf/20644045060.pdfIn PDF document text
    • https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/4fb6a40681b5107ef7cff1bbb845ec8c/gumunumirediw.pdfIn PDF document text
    • http://carsongrad75.com/clients/3/35/35717660c32d3dd9b0ffde8f33a19d23/File/nusaminugu.pdfIn PDF document text
    • http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16097d2851f68d---nizopipugafenulinaze.pdfIn PDF document text
    • https://sidexsideaudio.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2c1bba3127---madugu.pdfIn PDF document text
    • https://www.breastcancerfoundation.in/wp-content/plugins/super-forms/uploads/php/files/2c5af4766b3d17547df4ce825833af92/26792355345.pdfIn PDF document text
    • http://mxagproducts.com/upload/browse/file/zakumejopikogal.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cba6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCBA6 18176 bytes
SHA-256: 9c992171857bb53c7d4cd33c5440a38c7992293f816bc90ee7d1ec874576c382
font_01_sfnt_off0000fb65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB65 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0001137c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1137C 10428 bytes
SHA-256: 0959c3f12dd78d71d59f93928dfc9071fc10424334e92f081f3704d4289e6888

Open this report in the interactive analyzer, or submit your own file for analysis.