Malicious PDF — malware analysis report

Static analysis result for SHA-256 779045c336fbee41…

MALICIOUS

PDF

85.9 KB Created: 2021-06-17 05:43:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 951a8c560c0dcacf69c4d9c24c641a98 SHA-1: bc6e589b7836e452df547b301d9c548c88873cd4 SHA-256: 779045c336fbee413729c272a2c64ea28527be71ee969f8fd8438ef6271e37aa
204 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a PDF containing embedded JavaScript and multiple external URLs, many of which point to compromised WordPress sites or disposable hosting, suggesting a link farm for phishing or malware distribution. The 'SE_CLIPBOARD_COMMAND_LURE' heuristic indicates the document instructs the user to execute commands, a common tactic for downloading and running further malicious content. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 8

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/uplcv?utm_term=how+to+set+path+for+tomcat+server+in+windows+10 PDF link annotation
    • http://paintmaster.hu/js/ckfinder/userfiles/files/37109201899.pdfIn PDF document text
    • https://dispomydeal.com/wp-content/plugins/super-forms/uploads/php/files/c01ee52f2abae7a7f22cc707b8d1b459/28360723097.pdfIn PDF document text
    • https://burgas-remonti.com/userfiles/file/97125711343.pdfIn PDF document text
    • https://alenakovalchuk.ru/wp-content/plugins/super-forms/uploads/php/files/7a0b9e097527e345648915071e8e2597/67815841841.pdfIn PDF document text
    • https://binhruamuinanobac.com/wp-content/plugins/super-forms/uploads/php/files/bcl4o0if7amenre2didd831o8k/xokumovamubexutitosu.pdfIn PDF document text
    • http://shqinze.net/admin/upimg/file/%5C/degozemumijumakixu.pdfIn PDF document text
    • http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607eca1fcd9c7---fupip.pdfIn PDF document text
    • http://angelcabrera.com/FCKfiles/file/78995534211.pdfIn PDF document text
    • https://pluckywize.com/wp-content/plugins/formcraft/file-upload/server/content/files/16088c8768e074---30809395773.pdfIn PDF document text
    • https://ajitcoatings.com/uploads/45371216980.pdfIn PDF document text
    • http://www.communityheroesproject.org/wp-content/plugins/formcraft/file-upload/server/content/files/160741fc0239e5---disuxikixatale.pdfIn PDF document text
    • https://www.lightingsolutionsinc.net/wp-content/plugins/super-forms/uploads/php/files/39c5154377e46c6a9341686c2347c7ea/zibivivojug.pdfIn PDF document text
    • https://www.isgs.org/wp-content/plugins/super-forms/uploads/php/files/fc5e6d6f7a70b4bb95b0a2e65b2b83dc/vajaxoduxisipuxi.pdfIn PDF document text
    • https://malimbe.africa/wp-content/plugins/super-forms/uploads/php/files/c28a8dd0f91dc62532472dcfda40e32d/73717879182.pdfIn PDF document text
    • http://www.a-fairys-choice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d873979918---38011416118.pdfIn PDF document text
    • http://clinical-pain.com/pds/userfiles/files/27278616814.pdfIn PDF document text
    • http://aklond.com/UploadFilesfile/%5C/2021051202430213.pdfIn PDF document text
    • http://www.platformliften.info/wp-content/plugins/formcraft/file-upload/server/content/files/1608774a076907---21721837808.pdfIn PDF document text
    • https://www.accidentinjurylascruces.com/wp-content/plugins/super-forms/uploads/php/files/hpej2glu06fnj6n3afut241nq6/ziganuxesipawukaros.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ffcc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFCC 5456 bytes
SHA-256: 34c530c6cfc0c18a6b34042fcbf63ab4f5ab40618ebbc8970aa6cca033374f3c
font_01_sfnt_off00011244.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11244 1800 bytes
SHA-256: e9a5a1f6ed95b1e3669933bb00002ad32a1708c3e0b735191cad5e02368a6c7d
font_02_sfnt_off00011ad2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11AD2 11324 bytes
SHA-256: 0d6b803699ff24567ad37112602aa525732f88fe293c9a9121ac2ebdd995186f
font_03_sfnt_off0001419f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1419F 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.