Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b5a2f0a918e6dbe…

MALICIOUS

PDF

67.1 KB Created: 2021-06-24 20:37:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 5a2ca2bad74095db3a956db743890cfa SHA-1: e621f14880562f100755b33bb5dbbcb57c2c04f9 SHA-256: 7b5a2f0a918e6dbe4a5801c45ccb093a295c9917e60c24e2be4a7b336e73bda2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file functions as a link farm, directing users to numerous external URLs. Several of these URLs point to compromised WordPress installations, indicating a potential phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or distributing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=tara+vina+shyam+mane+mp3+download PDF link annotation
    • https://horizontire.com/userfiles/file/66794674187.pdfIn PDF document text
    • http://abwrva.com/uploads/files/kofotomasekabobalebu.pdfIn PDF document text
    • http://getem.pl/files/file/serev.pdfIn PDF document text
    • http://svsteinfurth.de/radsportfiles/file/21719920713.pdfIn PDF document text
    • https://www.citysecurity.org.uk/wp-content/plugins/super-forms/uploads/php/files/qno5d2pvokf728cicdg6123fhb/41779455019.pdfIn PDF document text
    • https://pluviaterra.mx/wp-content/plugins/super-forms/uploads/php/files/0b7b4049412bf91e6d0b74d7f6180c52/38391502666.pdfIn PDF document text
    • http://caribsplash.org/wp-content/plugins/formcraft/file-upload/server/content/files/160ab68eaf1561---65506690587.pdfIn PDF document text
    • https://ercrs.org/wp-content/plugins/super-forms/uploads/php/files/2b7962vq8fegqh9a8rf95nkjb3/45810737289.pdfIn PDF document text
    • https://www.d-table.com/wp-content/plugins/super-forms/uploads/php/files/083141466510ce5415caea75c2ce3435/74434210773.pdfIn PDF document text
    • https://windsbs.biz/files/file/4023009720.pdfIn PDF document text
    • http://conwaychristian.org/wp-content/plugins/formcraft/file-upload/server/content/files/1606c741ed7cd3---46426552987.pdfIn PDF document text
    • https://widepolymers.com/userfiles/file/zulilobubalikupekosutej.pdfIn PDF document text
    • http://broadviewlibrary.org/uploaded_bvlib/file/59678086795.pdfIn PDF document text
    • https://www.web2business.pt/wp-content/plugins/formcraft/file-upload/server/content/files/160b3a7235b82a---56515250705.pdfIn PDF document text
    • http://blueyee.com/upload/file/311118241870.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b863.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB863 5568 bytes
SHA-256: 9260b970d684c587219924fbb9be571c59d08743563a2f86c8982c941aefe973
font_01_sfnt_off0000cb45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCB45 10996 bytes
SHA-256: 985c14c04a7ee15bd0fc48755c9e778c3b863645ea69a9f7ea9bdd8fd751f3ae
font_02_sfnt_off0000f0f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0F3 3200 bytes
SHA-256: 7abbf8e922dfb606bf02f62dd235e41ea861ffc040da88e385246a645aeba60c

Open this report in the interactive analyzer, or submit your own file for analysis.