Malicious PDF — malware analysis report

Static analysis result for SHA-256 77d20e098363be21…

MALICIOUS

PDF

90.0 KB Created: 2021-06-11 11:11:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29
MD5: c6254a0747b6e1fc3eddf61141338b0d SHA-1: 02e7250bbaaa5748473a9d41d0e2c5a447da7a9e SHA-256: 77d20e098363be21ee47a718a923354a7cde98d456617deca64fa03529c3cc16
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains numerous embedded URLs, many pointing to compromised WordPress sites, suggesting a link farm designed to redirect users to malicious content. The presence of PDF_URI and PDF_SEO_DISPOSABLE_LINK_FARM heuristics further supports this attack pattern. No scripts were extracted, but the overall structure indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=agent+sai+srinivasa+athreya+movie+movierulz PDF link annotation
    • https://gpagroup.in/wp-content/plugins/formcraft/file-upload/server/content/files/1608243832e25a---90356205833.pdfIn PDF document text
    • http://capital96.com/userfiles/file/7912377312.pdfIn PDF document text
    • https://bonpetsupply.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072c7272732f---10236342765.pdfIn PDF document text
    • http://panziofabian.hu/fck_kepek/guzega.pdfIn PDF document text
    • https://member-amz-seller-system.de/wp-content/plugins/super-forms/uploads/php/files/5180438ea8ccf4d4fde0beeaa1dc51dd/lukaxadozagomutoda.pdfIn PDF document text
    • https://njsolarpower.com/wp-content/plugins/super-forms/uploads/php/files/5e8aa7e92f1645615c98a5118af1e1e9/96306132909.pdfIn PDF document text
    • http://isagenixmakessense.com/ckfinder/userfiles/files/naralatedavi.pdfIn PDF document text
    • http://www.orarestauratorisaf.it/wp-content/plugins/formcraft/file-upload/server/content/files/160888410cc699---8170366332.pdfIn PDF document text
    • https://www.keystonecare.co.uk/wp-content/plugins/super-forms/uploads/php/files/dd276e47becd31423d33a7f1d37fc705/52183499162.pdfIn PDF document text
    • https://duext.com/wp-content/plugins/super-forms/uploads/php/files/bc493b8551e1541feecc4559004d65d6/69953454293.pdfIn PDF document text
    • http://coyada.com/up_images/up_images/40222984236.pdfIn PDF document text
    • http://osullivanspressurewashing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a26c1c2b8ad---91030272214.pdfIn PDF document text
    • http://alpha-th.com/userfiles/file/medagober.pdfIn PDF document text
    • https://genesisbehaviorcenter.com/wp-content/plugins/super-forms/uploads/php/files/1f6f5df40aed0a2ccfd8cb80911e2b8b/gowox.pdfIn PDF document text
    • https://livingcircles.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1606cfa7d9191d---mulikogozigifuriraziw.pdfIn PDF document text
    • http://www.vitrierbxl.be/wp-content/plugins/formcraft/file-upload/server/content/files/160716773e6843---degofisuligigu.pdfIn PDF document text
    • http://musiconthebay.org/clients/2/26/269dd5bc96e197da989a8dccc71442af/File/jemam.pdfIn PDF document text
    • https://www.adilaltinsoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160750a55319f6---20070835695.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8C2 5300 bytes
SHA-256: 512e9cfb6fcb807aa06ef037493ed100e832d773656d440f680d64d023c20999
font_01_sfnt_off00010ab5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AB5 6508 bytes
SHA-256: 02364512871381208f86fc23474e900d03ee8933169159d6516f09c7ab4f4866
font_02_sfnt_off00011fc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11FC5 10720 bytes
SHA-256: ddb88e32dbb1fc3557cd5704f13e372a8c179103d7bf3f543cd410430050ab50
font_03_sfnt_off00014478.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14478 16164 bytes
SHA-256: e296a61d2d303e35be9e1a35631556663d2780498efa7e8f3867bf557f172fe6

Open this report in the interactive analyzer, or submit your own file for analysis.