Malicious PDF — malware analysis report

Static analysis result for SHA-256 7286f8218b90dcf2…

MALICIOUS

PDF

82.4 KB Created: 2021-08-27 13:18:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: a7a34ca4786825a6acd5784daa1749fb SHA-1: df52210f043e1c43572a3ab52842bc38c1c2c4a8 SHA-256: 7286f8218b90dcf21489bfb5fd6f63a99eb10b683a4cd5d55520044400ef8fe4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links, many pointing to compromised WordPress upload directories and disposable hosting, indicating a link farm designed to redirect users. The ML classifier and ClamAV detection strongly suggest malicious intent, likely for phishing or distributing further malware. The document body is heavily obfuscated, preventing a clear understanding of its specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9944

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.suffaheducation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608bc8f8aa7f4---25009671531.pdf In PDF document text
    • https://fcr-fomentoconsumoerenda.com/uploads/files/29063651435.pdfIn PDF document text
    • https://erdenet.mn/userfiles/file/73462730465.pdfIn PDF document text
    • https://blugarden.eu/file/firenofarevefanovid.pdfIn PDF document text
    • https://pankalconstructora.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608df80e0ada2---nuzefurutamabu.pdfIn PDF document text
    • http://bergfin.se/wp-content/plugins/formcraft/file-upload/server/content/files/16085e946aad54---jaxexewovenixomumiso.pdfIn PDF document text
    • http://www.lightingandhvacexpo.com/wp-content/plugins/super-forms/uploads/php/files/c680f065e6a9f28234180ab8ea4c96a7/werukobebi.pdfIn PDF document text
    • http://www.allatpatikapecs.hu/images/file/jisilemujo.pdfIn PDF document text
    • https://parisnordmedical.fr/docs/file/narozoginulirimuk.pdfIn PDF document text
    • http://thegioioto.store/upload/files/bajodigemixuferefizuk.pdfIn PDF document text
    • https://vaytieudungtragop.com.vn/wp-content/plugins/super-forms/uploads/php/files/g8p1nki50pmphup3ba2nsi6j6n/45448937785.pdfIn PDF document text
    • https://actioncoach.com.my/wp-content/plugins/formcraft/file-upload/server/content/files/160ac31cc51619---sosilukegavu.pdfIn PDF document text
    • http://coimbra.hu/uploads/ckfinder/userfiles/files/kaxakalunuwedisek.pdfIn PDF document text
    • https://tktravelkorea.com/FileData/ckfinder/files/20210825_5AF96D261B8AFAE6.pdfIn PDF document text
    • https://regeneracion-capilar.com/wp-content/plugins/super-forms/uploads/php/files/ce34e6780416ca1bc819019e9e7717cc/8643329943.pdfIn PDF document text
    • https://lostsoulsmemorialnj.org/wp-content/plugins/super-forms/uploads/php/files/1603c3b209d32acd63f3b9afc8894b57/lavametetadan.pdfIn PDF document text
    • https://www.citysecurity.org.uk/wp-content/plugins/super-forms/uploads/php/files/m0322baln2d98v1uvkugnsvos7/desubawonepanusogodowaweb.pdfIn PDF document text
    • https://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/97552a7e3c0dd4ef2734b544f52afdd7/masoxomimor.pdfIn PDF document text
    • http://supermarketdv.ru/files/file/24760566058.pdfIn PDF document text
    • http://lotuscourtpune.com/wp-content/plugins/super-forms/uploads/php/files/5c5auhh8l9h369i94g41amau87/58453755929.pdfIn PDF document text
    • http://dongxuyen.org/upload/files/dinaw.pdfIn PDF document text
    • http://hillsdale66ersreunion.com/clients/c/c6/c679c52642bc64dd8629b98fb95ccc77/File/romajusilanolepome.pdfIn PDF document text
    • http://pvsystexperts.com/wp-content/plugins/super-forms/uploads/php/files/dpcri7jiqmsn9fnu3d6qb20fi6/vinizomuwep.pdfIn PDF document text
    • https://n-zvuk.ru/upload/file/xuwamarujezifego.pdfIn PDF document text
    • https://assurancemauricie.com/wp-content/plugins/formcraft/file-upload/server/content/files/16110ccfcba221---54388683237.pdfIn PDF document text
    • https://harpethvalleypto.org/wp-content/plugins/super-forms/uploads/php/files/f1fb84dfa951437e9b4ceb65340bd41f/98914567281.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=an+example+of+a+physical+contaminant+is+aPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ddd5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDD5 10844 bytes
SHA-256: a76ae1ef1251b7ea75937e98da8904bd8a0d056b58bd93d7dd74792317f6915d
font_01_sfnt_off0000f6c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6C0 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00010ed2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10ED2 17364 bytes
SHA-256: 87f15efa4ee0c5c7612bee6c1bd110b27481a48c502dbc29e2c05778ceb86393

Open this report in the interactive analyzer, or submit your own file for analysis.