Malicious PDF — malware analysis report

Static analysis result for SHA-256 74ec54583954aa22…

MALICIOUS

PDF

85.2 KB Created: 2021-09-03 00:32:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: f2756ffdd97d960269725ba9317bcec2 SHA-1: f1759af9e037e700300b6f396afeed4e0aaaa3e5 SHA-256: 74ec54583954aa22f775f99b3694a1e6a8f8a3152b1541ce3284fe18d4d86fc9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous links, many pointing to compromised WordPress sites, suggesting it's designed to lead users to malicious content or downloads. The presence of a link farm on disposable hosting further supports a malicious intent to distribute harmful files or redirect users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://musikpark-live.de/userfiles/file/2240133381.pdf In PDF document text
    • https://boldvision.tv/wp-content/plugins/formcraft/file-upload/server/content/files/16080211b96f09---46819447924.pdfIn PDF document text
    • http://toddfamilyreunion.com/clients/4/48/482e924d5a052aa4a0c13eb8a30e0bc8/File/5603328420.pdfIn PDF document text
    • https://www.abaco-engineering.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609cfabfb447e---42131735903.pdfIn PDF document text
    • https://functionalmovement.gr/wp-content/plugins/super-forms/uploads/php/files/1f852d306c95d8a6ad8b6dc17bc52339/lajesotajasekatuneb.pdfIn PDF document text
    • https://www.andyselfstorage.co.uk/wp-content/plugins/super-forms/uploads/php/files/8va0jmclvimpj20no7v4nse21d/36763056464.pdfIn PDF document text
    • http://asalsold.com/wp-content/plugins/formcraft/file-upload/server/content/files/16129625dd852f---mumujirezovu.pdfIn PDF document text
    • https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/2c449ba14ab03df5b6fca82ef61478b4/92163615733.pdfIn PDF document text
    • https://craftsmancuttingdies.com/wp-content/plugins/super-forms/uploads/php/files/c34d840ca0edd0459ce111b6cc6f8b07/73252001249.pdfIn PDF document text
    • https://vinacoma3.vn/userfiles/file/41699899844.pdfIn PDF document text
    • https://amoslodge10.org/ckfinder/userfiles/files/30371672658.pdfIn PDF document text
    • https://dutchfansitenetwork.nl/ckfinder/userfiles/files/81264346116.pdfIn PDF document text
    • http://chocolatycakes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a4619e5caa---90891504850.pdfIn PDF document text
    • https://laser-arena.ch/wp-content/plugins/formcraft/file-upload/server/content/files/16075e7f302481---kuxudanijujobo.pdfIn PDF document text
    • https://www.enviedecrire.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c4ad097997---gegevevix.pdfIn PDF document text
    • http://modern-pro.ru/files/file/7097576686.pdfIn PDF document text
    • https://securityguardsupply.net/php/uploads/file/fakemujepatokadulobidi.pdfIn PDF document text
    • https://qualitylightsolutions.com/wp-content/plugins/super-forms/uploads/php/files/e3eedf57c3d584f526bc641dd9c665e9/jutawozepakagon.pdfIn PDF document text
    • http://www.instalacionescueto.com/nueva/ckfinder/userfiles/files/nubafifavax.pdfIn PDF document text
    • https://envomask.com/wp-content/plugins/super-forms/uploads/php/files/c68b878209d2c78d0d91cfefc8fbca03/3184038588.pdfIn PDF document text
    • https://sudhirsachdevaclasses.com/ci/userfiles/files/7996399623.pdfIn PDF document text
    • https://laihouston.com/wp-content/plugins/super-forms/uploads/php/files/33475e7ef5271c2deebb8c883628a34a/vavarumezoriletekimo.pdfIn PDF document text
    • https://dazzlin.co.uk/wp-content/plugins/super-forms/uploads/php/files/e843bb6c4a5a1b5a4bf872c98250d71d/83495366016.pdfIn PDF document text
    • https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160827732bff95---19813370784.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/3vuEKuznOb8/uplcv?utm_term=microdrainage+user+manualPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7C2 17992 bytes
SHA-256: 0c3dc5c32874f989a5818d7c782a9e6c79f2342a8baa2a1fab0ac92b61b0f47f
font_01_sfnt_off000116b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x116B9 10708 bytes
SHA-256: db1fc35ac2983416b0f8cf72bf5ea99849d990f220fa7ba7a3bddaa4358f2838
font_02_sfnt_off00012f0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F0B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.