Malicious PDF — malware analysis report

Static analysis result for SHA-256 83dfc185e5970b72…

MALICIOUS

PDF

86.3 KB Created: 2021-06-29 12:54:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 727366a9bda1626e72a2e6bd526fda63 SHA-1: e11f440fb4218b9b530c2d0ca5c5eec11b9ae6a5 SHA-256: 83dfc185e5970b72c0b9cf9aed707ad88f2277e8d499711c7c83f4dda7ef56c9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. It contains numerous external links, many pointing to compromised WordPress upload directories or disposable hosting, suggesting a link farm designed to redirect users to malicious content. The presence of these links and the overall detection profile indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/uplcv?utm_term=safety+plan+template+for+parents
    • https://aljazeerahpetroleum.ae/userfiles/files/51826530704.pdf
    • http://kondicionery-vidnoe.ru/upload_picture/file/2834911698.pdf
    • https://bettenbaehren.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607930415b65a---66553828278.pdf
    • http://www.guaitoli.eng.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a555765f4ca---sasugoziguf.pdf
    • http://fortlauderdalelimorental.net/wp-content/plugins/formcraft/file-upload/server/content/files/160af6a946201e---gobes.pdf
    • https://phoenixknights.co.uk/wp-content/plugins/super-forms/uploads/php/files/fb96e2424429a01b7a3854b8f71ed22b/doxijadetasuvedej.pdf
    • https://www.scanworld.se/wp-content/plugins/formcraft/file-upload/server/content/files/1607ca64d967be---68041713282.pdf
    • http://apsara.ru/userfiles/file/xenunotavumapamo.pdf
    • https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/1ad061891d74864aad1075320f5f02c4/73203592553.pdf
    • https://ahi.com.ua/wp-content/plugins/super-forms/uploads/php/files/9ef6728c3e55b56eb52acd3042cde3d6/jonetukukebeponopiv.pdf
    • http://www.sparkprototypes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160af9510d74d5---95713851000.pdf
    • https://cbolean.com/wp-content/plugins/super-forms/uploads/php/files/knnnpnp9fvfr0u4ab2d69il212/41977684635.pdf
    • https://stellabakingcompany.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c933d1de0da---tozevora.pdf
    • https://postscriptproductions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab191538318---67493216373.pdf
    • https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160d1b9eb1f720---89830049443.pdf
    • https://expungemyrecordnj.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a68b8950bf3---zakivo.pdf
    • https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/5044f20174dd46c38e89f4176bab682d/70316465149.pdf
    • https://www.hauptsache.cc/wp-content/plugins/formcraft/file-upload/server/content/files/160bf9a1f54f11---basunisumeduvewifow.pdf
    • https://greshamgilessalon.com/wp-content/plugins/super-forms/uploads/php/files/b892a3dd128d67d74dde2d638adc000c/gekofunen.pdf
    • http://anandtouristcorporation.com/uploads/68316907922.pdf
    • https://lokmangal.co.in/wp-content/plugins/super-forms/uploads/php/files/a9984e3c4bd4be4847c9faa2eb9d3ed0/bofofakenenuzomuvewaz.pdf
    • http://cargo3030.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160d19b5932049---zibexa.pdf
    • https://kildevangen.dk/files/59104629352.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f096.bin
4e890df3550d6fc8bb4402e247578530422fea4dbefb728aff08512543a63407		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF096 16544 bytes
font_01_sfnt_off00011b9e.bin
d2ebb63a6de8d7900f8c44a44a53c7e46ae1519500e4c4e2f398e09bd5f4fd53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B9E 10616 bytes
font_02_sfnt_off000133e9.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x133E9 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.