Malicious PDF — malware analysis report

Static analysis result for SHA-256 6dfe4f089bccc7ab…

MALICIOUS

PDF

75.3 KB Created: 2021-06-19 13:06:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: a219f7bd43a68d96aa3ebc9a16566051 SHA-1: d528400f760f7da97164c47121e80e1a0abe68fd SHA-256: 6dfe4f089bccc7abf4cf74518ca5844e71b5489737bf3c3669402ef100b257da
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics and an ML classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains numerous links to external websites, many hosted on compromised CMS platforms, suggesting a link farm designed to redirect users to malicious content. The document body is heavily obfuscated and does not provide clear instructions, but the presence of many unknown URLs points towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://robertmatzuzi-massagetherapist.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160b299b84c1e4---fujivulofogira.pdf In PDF document text
    • http://sillajen.com/fckeditor/_upload/file/nobuxolete.pdfIn PDF document text
    • http://www.canadiantreasurer.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a97dd24c0ad---mifowakomojikokerodifewut.pdfIn PDF document text
    • https://ecoinkworld.com/wp-content/plugins/super-forms/uploads/php/files/c67d0853372cd8d26ef40a02e572f558/67648138842.pdfIn PDF document text
    • http://thm-holding.ru/wp-content/plugins/super-forms/uploads/php/files/2ecff1b4b2d3b0a1eca8c6c775f64bfa/84427356980.pdfIn PDF document text
    • https://www.rekalibracija.com/wp-content/plugins/super-forms/uploads/php/files/f8e89c7bf0c89adbab103cd447b621f5/81223346708.pdfIn PDF document text
    • https://udachi.co.th/wp-content/plugins/super-forms/uploads/php/files/meqffbc21ocs56v9k3s00djur3/bujikeno.pdfIn PDF document text
    • https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/tvoigjcf1m1ncuk8gb7gomdu6d/xawetizajusas.pdfIn PDF document text
    • https://www.ogblfrontaliers.fr/wp-content/plugins/super-forms/uploads/php/files/jm6ns3u90ao3ioo43u13s15fsq/12992148256.pdfIn PDF document text
    • https://bykevin.com/wp-content/plugins/super-forms/uploads/php/files/ef033aa34282d91c6f6e8b4a7fd40294/85133968034.pdfIn PDF document text
    • https://mosoptagro.ru/wp-content/plugins/super-forms/uploads/php/files/20b779e4fe8e1cc1b7e39c570b3e9d70/wumojonadag.pdfIn PDF document text
    • http://rencontres-icare.org/userfiles/file/37912684657.pdfIn PDF document text
    • http://abc-tel.ru/data/File/38912046399.pdfIn PDF document text
    • http://kochamsushi.pl/UserFiles/file/tuvexebub.pdfIn PDF document text
    • http://www.thelawchamber.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079d46e65001---64292840285.pdfIn PDF document text
    • http://accu-chek-event.com/ckupload/files/11098160985.pdfIn PDF document text
    • https://voolabs.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b03bcdf624---bobogeliwebubi.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=la+la+land+mp3PDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000d438.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD438 13268 bytes
SHA-256: 4e004f1db7ee83ed2ffc88d4b3f1e7f5bc2820e11e45bc804abfccc8de3ef17e
font_00_sfnt_off0000c384.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC384 4936 bytes
SHA-256: 3f7d4f7852d140e119bdc95a5f69902dd87e15889cd962e436bcb8b90ad80226
font_02_sfnt_off0000f94c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF94C 11516 bytes
SHA-256: 23e37ebad820c2fd3845c0cca8ce38be3adf29b0afb025870abf0609d8225f3e

Open this report in the interactive analyzer, or submit your own file for analysis.