Malicious PDF — malware analysis report

Static analysis result for SHA-256 79a3089f1bc34da0…

MALICIOUS

PDF

158.7 KB Created: 2021-06-27 10:34:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: df95df88c84f3be15e070833b9dae883 SHA-1: aa97552dcd60a24324d946ba7b1c0bac9bcd6eda SHA-256: 79a3089f1bc34da05c35d2c2c790d60728f02aee4c606b6fabb2ca97b24c2ffc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a large number of links, many of which point to compromised WordPress sites hosting other PDF files. This behavior is indicative of a link farm designed to distribute malicious content or lead users to phishing sites. The ML classifier and ClamAV detection strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9913

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://antik-cafe-bergen.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607e09abc23e6---fowujixikaraxudazisojukir.pdf In PDF document text
    • https://www.northernillumination.com/wp-content/plugins/super-forms/uploads/php/files/86382989279f88a528fbc1ed82259ee6/zigagadariso.pdfIn PDF document text
    • https://hmjrgoldhockey.org/wp-content/plugins/super-forms/uploads/php/files/676844230407e89fe4f3abbe525662b7/6231217556.pdfIn PDF document text
    • https://youstore21.com/wp-content/plugins/super-forms/uploads/php/files/e48b7044c9a531eec55c0bbc31f0d7ea/21465478075.pdfIn PDF document text
    • https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/cvhv8q68sf5ps4t4e7snue55h1/51583437352.pdfIn PDF document text
    • https://sharadsangam.org/UserFilesTwo/file/28081096001.pdfIn PDF document text
    • https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/64c439950b0745341638d2937844e9c3/30123270780.pdfIn PDF document text
    • http://www.mywil.ch/wp-content/plugins/formcraft/file-upload/server/content/files/16079f9eedb84b---68445547476.pdfIn PDF document text
    • http://associacaoguainumbi.org.br/wp/wp-content/plugins/formcraft/file-upload/server/content/files/160717f736d7cb---85952430116.pdfIn PDF document text
    • http://djpress.pl/Image/files/xafodipimev.pdfIn PDF document text
    • https://www.gml.de/wp-content/plugins/formcraft/file-upload/server/content/files/16080f2724fe07---widilisopudefigedagugavo.pdfIn PDF document text
    • http://gennarimaq.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160798bda7a7f9---98371739038.pdfIn PDF document text
    • http://www.microsinusectomi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f457f81581---xubobodixowugivuzilopuko.pdfIn PDF document text
    • http://animationcoach.com/userfiles/file/pewevuke.pdfIn PDF document text
    • http://fly.no1-yes.com/userfiles/file/gulapalomopuzejewufutoja.pdfIn PDF document text
    • https://xn--80aaa1anac6cg.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/8d577a0f920509a2b763d1468a758c19/pezamobofane.pdfIn PDF document text
    • https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/b530ef07325660c18d469f85a805ffd3/likodozuvalufewes.pdfIn PDF document text
    • http://longthinhphat.net/uploads/files/wolel.pdfIn PDF document text
    • http://bamt.be/wp-content/plugins/formcraft/file-upload/server/content/files/160abf66759c88---nizoxabojirunakotitaw.pdfIn PDF document text
    • http://baigeleather.com/userfiles/file/34487446529.pdfIn PDF document text
    • http://www.jesuseslaroca.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a16ad97740b---bodojanakez.pdfIn PDF document text
    • https://wccia-vastu.com/wp-content/plugins/super-forms/uploads/php/files/4e430594b3256fc75fb479d13f370ba5/xijumejikilajal.pdfIn PDF document text
    • http://bagandpack.ru/wp-content/plugins/super-forms/uploads/php/files/d58c90767bf3a843e4e8c963931e4cb7/kijajegaligobilasidu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=transurethral+resection+meaningPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00021035.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21035 10740 bytes
SHA-256: f144deddbec6d4e70aa11bc90c4b098326cd236839410f5ad01ffde451f439bc
font_01_sfnt_off000228b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x228B4 16872 bytes
SHA-256: 56eb3b9cb9c4080ab0bd6f8ade6471c4bfd47cdd91f93a67e0b20986ad07c8a7
font_02_sfnt_off000254ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x254ED 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.