Malicious PDF — malware analysis report

Static analysis result for SHA-256 7455a6daf3aa885f…

MALICIOUS

PDF

149.5 KB Created: 2021-06-25 23:25:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: 201e9132e8b416808617918c01f307db SHA-1: 579eea186748e3201dbf677401ecb7b0d6a607ab SHA-256: 7455a6daf3aa885f67ab72ba8920a77eced6135e8cbb69506bebcbaf1016e959
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external URIs and embedded links that point to compromised WordPress sites and disposable hosting, suggesting it functions as a link farm. The primary purpose appears to be directing users to potentially malicious websites, likely for phishing or malware distribution, which aligns with the 'Spearphishing Attachment' technique.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9913

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=daily+reading+comprehension+grade+4+answer+key PDF link annotation
    • https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/516e27da5d189bd8d7955bc4104ccd72/lirelukarusuz.pdfIn PDF document text
    • https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/d377c400b3f3eeade93e0652db807db3/5027316542.pdfIn PDF document text
    • http://komputerzagrosze.pl/userfiles/file/6192672752.pdfIn PDF document text
    • http://entone.es/wp-content/plugins/super-forms/uploads/php/files/8bd0bad8604b9fa7831b98916ce8f85c/40005810765.pdfIn PDF document text
    • http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/9915a4a4de1f3c77deaa85c78725b1ff/wewekozuxuneto.pdfIn PDF document text
    • http://www.ellisrasbetonwerke.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160d20d729836b---66272115571.pdfIn PDF document text
    • https://mygamedaysports.com/wp-content/plugins/super-forms/uploads/php/files/afb2bf136af09ddee4c019d1f63a8765/34080414393.pdfIn PDF document text
    • http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606fc1d80378d---7731309491.pdfIn PDF document text
    • https://aawyx.com/sites/default/imageuser/file/91604800512.pdfIn PDF document text
    • http://altinay-law.com/images/file/fawibumudupo.pdfIn PDF document text
    • http://energo-winstal.pl/userfiles/file/78959360973.pdfIn PDF document text
    • http://www.reroofingbrisbaneqld.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16074b5f97a4bf---romamadufilagepeson.pdfIn PDF document text
    • https://sellerflows.com/wp-content/plugins/super-forms/uploads/php/files/f2fea7fd4df158ee39c0bd2247fbf8d3/99264846472.pdfIn PDF document text
    • https://www.picmephotoboothhire.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16098408e6589e---wupofogugozoxivapaxi.pdfIn PDF document text
    • http://lycee-elm.org/userfiles/file/2972669639.pdfIn PDF document text
    • http://yournamebadges.com/withyourdog/cms_uploads/file/45098070416.pdfIn PDF document text
    • http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a42389a94b---42850769703.pdfIn PDF document text
    • http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090ee1dca793---90311726416.pdfIn PDF document text
    • http://nd-58.ru/wp-content/plugins/super-forms/uploads/php/files/3873cd310824def74f4564896348ff58/vajefeb.pdfIn PDF document text
    • https://www.aserspa.net/wp-content/plugins/super-forms/uploads/php/files/ip5ctli9u7pmn1cu6qih0pd885/pipivilenukunegom.pdfIn PDF document text
    • http://purpledoorchurch.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079294ce82d0---61233821203.pdfIn PDF document text
    • https://aryaayur.com/wp-content/plugins/formcraft/file-upload/server/content/files/160988d650b97c---95479594793.pdfIn PDF document text
    • http://ruilong-ironwork.com/CKEdit/upload/files/begejokorufida.pdfIn PDF document text
    • https://ceilford.org/wp-content/plugins/super-forms/uploads/php/files/aa6da9479d51fd173c777c942f1833d0/72843211758.pdfIn PDF document text
    • http://baharemadinah.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080724065fc1---23513432533.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001e220.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E220 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0001fa32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FA32 18948 bytes
SHA-256: c03b63a604d171b30d049f33ae1e702a8f726d1b3c70a1b7459583d5b413c087
font_02_sfnt_off00022c45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22C45 11232 bytes
SHA-256: a8768ff3543ef8a84de31c29bfce461d2afb560849a1268496cf4aa089b49d8b

Open this report in the interactive analyzer, or submit your own file for analysis.