Malicious PDF — malware analysis report

Static analysis result for SHA-256 81a111bbcc3271ac…

MALICIOUS

PDF

94.6 KB Created: 2021-08-14 01:57:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14
MD5: 335ef468bac689330be70cb5b7b6167c SHA-1: bd3245fc66a72211d0c9b73de696a97945f12741 SHA-256: 81a111bbcc3271acb0ef9b8e6e775d90ba3b500965613a7a95ce4f3de270d6af
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains a large number of external URIs, many pointing to compromised WordPress upload directories, suggesting a link farm designed to redirect users to malicious content. The document body is heavily obfuscated and unreadable, but the presence of numerous links and the overall heuristic profile indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9928

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/uplcv?utm_term=hard+reset+sharp+aquos+305sh+softbank PDF link annotation
    • http://geology.ie/wp-content/plugins/formcraft/file-upload/server/content/files/1607ef57baabcb---ziropiduziti.pdfIn PDF document text
    • http://armanetti.com/images/risegoxirafuboponume.pdfIn PDF document text
    • http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160f79a528913f---wabulekigubifosufazamowef.pdfIn PDF document text
    • https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608143f71cdac---97894592727.pdfIn PDF document text
    • http://alliance-ic.ru/uploads/file/kujoxusomunimapebinem.pdfIn PDF document text
    • http://www.hkqi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a5f17c3177---19615022843.pdfIn PDF document text
    • http://keyflounge.nl/userfiles/file/pajozejivowego.pdfIn PDF document text
    • http://livestreaming.group/wp-content/plugins/super-forms/uploads/php/files/vqf51t6v8e2ht65avd68f26p9o05v053/jonika.pdfIn PDF document text
    • https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/lo8fh9mpvr5tpdd13avogsr6jd/dajav.pdfIn PDF document text
    • https://ooo-kenk.ru/userfiles/file/23723448545.pdfIn PDF document text
    • https://cms.blauraum.com/wp-content/plugins/super-forms/uploads/php/files/59d3566eb56d7b5ee0a9a971fa2035bc/bufivego.pdfIn PDF document text
    • http://aisef.org/uploads/userfiles/file/file/9886922597.pdfIn PDF document text
    • https://behagi.eus/files/galeria/files/noxuribofowixal.pdfIn PDF document text
    • https://alihuata.com/userfiles/file/vekagapop.pdfIn PDF document text
    • https://www.psalighting.com/wp-content/plugins/super-forms/uploads/php/files/2c854037f4dc7564d54897656a99cb4d/24449394795.pdfIn PDF document text
    • http://mopi.eu/ckfinder/userfiles/files/95950164831.pdfIn PDF document text
    • http://bright-mineral.com/uploadfile/file/2021061904304878.pdfIn PDF document text
    • https://amitadevnani.com/userfiles/file/47339629740.pdfIn PDF document text
    • http://xn--b1ahhafccpgkb2bxo.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/36beae4b308e11a4e61ffb7d0e9a7650/zexivakalugozepi.pdfIn PDF document text
    • http://clinicaveterinariaalbese.eu/userfiles/files/maxasaletipopojelirazuv.pdfIn PDF document text
    • http://mountmedpharmacy.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607522d1b0886---pifeluporobo.pdfIn PDF document text
    • http://bachova-terapia.sk/images/file/39475487334.pdfIn PDF document text
    • https://www.hauptsache.cc/wp-content/plugins/formcraft/file-upload/server/content/files/160a5168cdedea---vimawisinelonupojuwuf.pdfIn PDF document text
    • http://emailreceptionist.net/userfiles/file/mawale.pdfIn PDF document text
    • http://print-printonline.com/ckfinder/userfiles/files/rusewitimo.pdfIn PDF document text
    • http://donaldnathanlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/lofomejo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB0A 24240 bytes
SHA-256: 4fd03affd7ddc95993a17d0c273e5b86a9c7ae58bbacb700e5c4965b11e31a7e
font_01_sfnt_off00013733.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13733 11352 bytes
SHA-256: 78071516846f95708526dc3f3bcdf724add5b4edcb3c2109f6718ee0c88d0351
font_02_sfnt_off0001516c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1516C 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.