Malicious PDF — malware analysis report

Static analysis result for SHA-256 67506c53ff875f7b…

MALICIOUS

PDF

83.9 KB Created: 2021-06-15 20:54:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-24
MD5: 5ccf98c0bf92255995c80040b8fd8cfb SHA-1: d4f44c5637a63839bdbc9cc0a60a39068eed2af7 SHA-256: 67506c53ff875f7bc9c07137ec26043947b14e5f7bcb53a9249e3a207d3a9c55
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm pointing to various compromised websites, disguised as a 'Finances spreadsheet template'. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to deliver a phishing or malware payload. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=finances+spreadsheet+template PDF link annotation
    • http://progfin.pl/userfiles/file/kelebikumebasujet.pdfIn PDF document text
    • https://www.olympusnorge.no/wp-content/plugins/super-forms/uploads/php/files/ue15qjvdhrl9aem1f3m26961cm/70342206448.pdfIn PDF document text
    • https://www.mercato.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1608fe8a73b7b9---bopevazububona.pdfIn PDF document text
    • http://bright-mineral.com/uploadfile/file/2021052904291613.pdfIn PDF document text
    • http://www.shipsupply.co.mz/wp-content/plugins/formcraft/file-upload/server/content/files/160b46807be0ad---leludajebikaxiluviwut.pdfIn PDF document text
    • https://www.pal-kont.hu/wp-content/plugins/super-forms/uploads/php/files/121dce107ebff400d90bda81baab5e3d/71142242068.pdfIn PDF document text
    • https://patriot.ch/wp-content/plugins/super-forms/uploads/php/files/ol3lkjp3vpv7g417kilpke6ttc/xagodazezileroza.pdfIn PDF document text
    • https://www.duffylighting.com/wp-content/plugins/super-forms/uploads/php/files/ed6791b9ff2481d6a485f1e754157ddb/woxugiv.pdfIn PDF document text
    • https://singaporeroadshow.com/wp-content/plugins/super-forms/uploads/php/files/579d7696d701f08ee6e551b3f69e596b/fonajelexefa.pdfIn PDF document text
    • http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608fea1c87fe3---mubikekirukaronido.pdfIn PDF document text
    • https://comodee.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084abf21d70b---tabive.pdfIn PDF document text
    • http://pressvaluation.net/userfiles/file/kabutozuloduriwon.pdfIn PDF document text
    • http://www.associatedomains.com/wp-content/plugins/formcraft/file-upload/server/content/files/160afd2c054f80---3128838905.pdfIn PDF document text
    • http://adoriantarla.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16085a042934e2---50667712113.pdfIn PDF document text
    • https://www.enviedecrire.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a04991804c7---vusirarubipixuj.pdfIn PDF document text
    • https://dimensioninteractive.com/WYSIWYGImage/file/wixebam.pdfIn PDF document text
    • https://www.expoagrogto.com/wp-content/plugins/super-forms/uploads/php/files/345dq0qfvt7134o0cg3seqsbq0/21788113155.pdfIn PDF document text
    • http://ttlengenharia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607a8ad609873---34565197683.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc15.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC15 4948 bytes
SHA-256: e4733e1cad52d8234e80f2f832084cc59a37bb9ddf88206a336127a5c815c107
font_01_sfnt_off00010ca4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CA4 11676 bytes
SHA-256: ed51974d6d18aadd2e4b3b356c26780b0eca8162a554efdd4f060bf6fe119be5
font_02_sfnt_off00013469.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13469 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.