Malicious PDF — malware analysis report

Static analysis result for SHA-256 78168e9691762645…

MALICIOUS

PDF

69.2 KB Created: 2021-09-30 15:46:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: dd4e39addb4d8cb126981a31566fc169 SHA-1: f5d78aae9c32ce2dee0f64054991925982cfae3f SHA-256: 78168e9691762645f929ca1ef5d1372df2ad5497b3f804e92c990d489723774e
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file is identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing lure. The PDF_IMAGE_LURE heuristic indicates it presents an image to the user, likely hiding a clickable action that redirects to external URLs. The numerous embedded URLs, many pointing to compromised CMS uploads or disposable hosting, suggest a link farm designed to distribute further malicious content or phish for credentials. No scripts were extracted, but the overall structure and URL patterns strongly indicate a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 69 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/uplcv?utm_term=vlc+for+android+pc+download PDF link annotation
    • http://sieuthihatgiong.vn/webroot/img/files/fofuxax.pdfIn PDF document text
    • https://123natura.com/stockages/files/nulawinub.pdfIn PDF document text
    • http://greenworx.eu/images/uploads/files/9198265088.pdfIn PDF document text
    • http://tinavaron.com/ckfinder/userfiles/files/zibuvaper.pdfIn PDF document text
    • https://teplitsyoptom.ru/wp-content/plugins/super-forms/uploads/php/files/ef9f2b9611a3193a59315622d9346143/27961831876.pdfIn PDF document text
    • https://bizdrive.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/16140edc158a7e---12833015191.pdfIn PDF document text
    • https://sf-tfi-pgu.uz/wp-content/plugins/super-forms/uploads/php/files/7e08a3a9c4ca0866971cd2eede169dea/93830172830.pdfIn PDF document text
    • https://themalc.org/files/file/38971770450.pdfIn PDF document text
    • https://matharu.ae/userfiles/file/52933691035.pdfIn PDF document text
    • http://xn--80aaaghhaztbcd1agjgbccsgfftf.xn--p1ai/pict/file/loradamobenovemano.pdfIn PDF document text
    • http://luxlustry.ru/img/upload/dotuzekelidamafoxokubuk.pdfIn PDF document text
    • https://dodomacnosti.net/data/file/42363079899.pdfIn PDF document text
    • http://capmar.eu/userfiles/file/10177585711.pdfIn PDF document text
    • http://thesciencenetwork.org/uploads/files/73131717647.pdfIn PDF document text
    • http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/hkrd3q2i61dpcfsq7158hcqij2/48394372429.pdfIn PDF document text
    • http://utcsp.rustyramone.com/uploads/files/sofibuxabaposo.pdfIn PDF document text
    • http://righetti-ticozzi.it/userfiles/files/zonometowojuvixoraru.pdfIn PDF document text
    • https://nmg.lv/img/uploads/files/dilisagonurufawukogobes.pdfIn PDF document text
    • https://hoangvan.vn/wp-content/uploads/files/52463777849.pdfIn PDF document text
    • http://izmirtavla.com/upload/file/68885000350.pdfIn PDF document text
    • http://zjnep.com/ckeditor/ckfinder/userfiles/files/pumupebepep.pdfIn PDF document text
    • http://xn--90afqerdlt1f.xn--p1ai/admin/ckfinder/userfiles/files/bafotosoletidebam.pdfIn PDF document text
    • http://aquarium-kochi.com/app/webroot/ckfinder/userfiles/files/29353204755.pdfIn PDF document text
    • http://kurskodkb.ru/page_edit/_samples/userfiles/files/moxapolikupenazimopisemu.pdfIn PDF document text
    • http://aias.pnu.ac.th/ckfinder/userfiles/files/35067636237.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b429.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB429 14392 bytes
SHA-256: a7ef3c1398093795846b65c4fb0d907690bcdc81ecc1efb9da44baad54a38782
font_01_sfnt_off0000d7a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7A0 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000efb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFB7 10272 bytes
SHA-256: c0926a03afa807b7b4a972b6a9cc4e45e7c34ca1966aa307a6b9e49ffa9318f1

Open this report in the interactive analyzer, or submit your own file for analysis.