Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a5cc615f86b0ff7…

MALICIOUS

PDF

85.5 KB Created: 2021-08-20 05:00:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: 76d3f411f7f6d28b4e125cea8546b9ac SHA-1: 0a84008981eac8d876f442022cf44ecbad1098b6 SHA-256: 6a5cc615f86b0ff7da70be1ed5c2241f340830dcbf990bfd230278d503419499
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a link farm with numerous URLs pointing to compromised CMS upload storage and disposable hosting, suggesting a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and URL patterns are indicative of malicious activity, likely involving redirection to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mamproducciones.es/wp-content/plugins/formcraft/file-upload/server/content/files/160c25872e1d6a---62521633457.pdf In PDF document text
    • http://lichnyiybrand.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160ac64ef36067---sawejosidibuwopevux.pdfIn PDF document text
    • http://peterpan1996.it/userfiles/files/43742062092.pdfIn PDF document text
    • https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/dbf99be20634691abc920cb3876e7443/lofadem.pdfIn PDF document text
    • http://brenno-tojestto.pl/userfiles/file/dagopafizopixaxafevobosi.pdfIn PDF document text
    • https://hijaustabilo.com/contents//files/33313099746.pdfIn PDF document text
    • http://inbeeldt.nl/userfiles/file/gojujulusadep.pdfIn PDF document text
    • https://solener.info/ckfinder/userfiles/files/nesenu.pdfIn PDF document text
    • http://geombiagioschettino.eu/userfiles/files/rurafajovebaxevidibita.pdfIn PDF document text
    • https://www.chauffeur-prive-nice.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160ac4ae7103a1---8178323177.pdfIn PDF document text
    • https://www.adelaarenergy.com/wp-content/plugins/super-forms/uploads/php/files/vpumch24m215j39h335d47qtd1/milufa.pdfIn PDF document text
    • https://oneremote.ru/wp-content/plugins/super-forms/uploads/php/files/adaf3e9d18b64241497d310a6184d296/4291867993.pdfIn PDF document text
    • http://roomyab.ir/basefile/roomyabir/files/sirasuwolusimon.pdfIn PDF document text
    • https://www.pharmaright.ca/wp-content/plugins/super-forms/uploads/php/files/3dkkflcou3ug2eo5dkgeh4issg/bubawuliwigomumutifimi.pdfIn PDF document text
    • http://scottleddy.net/clients/862555/File/68663220739.pdfIn PDF document text
    • http://www.maarsehoveniers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c9d94e96eae---nopivowasuwuzakibemu.pdfIn PDF document text
    • http://escolacaritas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f5ded69d20f---2401584352.pdfIn PDF document text
    • https://traveltokiev.com/wp-content/plugins/super-forms/uploads/php/files/478dqq4ugbi5d6kq214441vag2/kaxebumolu.pdfIn PDF document text
    • http://alarcon-v.com/editor_upload_image/file/82980100435.pdfIn PDF document text
    • http://studioingegneriavaragnolo.com/userfiles/files/89227396639.pdfIn PDF document text
    • http://3handseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610f99802752d---57710327842.pdfIn PDF document text
    • https://k-newsletter.com/ckupload/files/35482248201.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=wanted+full+movie+hindi+download+mp4+pagalworldPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA8C 16676 bytes
SHA-256: a8926c9f560fd10f852e3bc94af706e6457c25762c4cdd27e2686c954d9c8574
font_01_sfnt_off000115f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115F6 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00012e0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E0D 11100 bytes
SHA-256: c993303e3c842c955a4d138955bd314cffd69cc6347adc21ce3426c525dcc240

Open this report in the interactive analyzer, or submit your own file for analysis.