Malicious PDF — malware analysis report

Static analysis result for SHA-256 84575725fd053775…

MALICIOUS

PDF

95.3 KB Created: 2021-06-29 01:46:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: acd71a58eb2a7d3d66a8136e9b990129 SHA-1: fcd640d7cb93f0978579e46017b77235bb3f667f SHA-256: 84575725fd053775c729e66b9ff0db47a5496d928fd55ff25544a78d6bfd025b
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It functions as a link farm, directing users to various compromised websites, likely to download further malicious payloads. The presence of multiple external URIs and the 'SE_DOWNLOAD_BUTTON' heuristic suggest a lure-based attack pattern designed to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9786

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/uplcv?utm_term=chapter+4+question+answer PDF link annotation
    • https://unitedcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607faf37c0002---52793830321.pdfIn PDF document text
    • https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/f6da9b5fa095d6bb2b4b75c02570b15d/38441590460.pdfIn PDF document text
    • http://optimus.org.au/wp-content/plugins/formcraft/file-upload/server/content/files/16089ccfb9f672---30760709961.pdfIn PDF document text
    • http://libertyquad72.fr/userfiles/file/vudogowaxixiletejabadeb.pdfIn PDF document text
    • http://debden.org/userfiles/file/2792302453.pdfIn PDF document text
    • https://srmhomes.com/images/bulk_images/files/53503359745.pdfIn PDF document text
    • http://churchliferesources.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607dba793ef4b---zojewilafa.pdfIn PDF document text
    • http://abpaluso.com/upload/file/2563208096.pdfIn PDF document text
    • http://handsonmontessoripk.com/userfiles/files/80822381003.pdfIn PDF document text
    • https://www.avenueroadadvertising.com/wp-content/plugins/formcraft/file-upload/server/content/files/160946a12d50f1---wotekipo.pdfIn PDF document text
    • http://geoodwierty.pl/files/file/48248328113.pdfIn PDF document text
    • https://djhelaly.com/wp-content/plugins/super-forms/uploads/php/files/182eab28ff5055c22b3d183eebc1d829/naluremetavizado.pdfIn PDF document text
    • https://borderpak.com/wp-content/plugins/super-forms/uploads/php/files/dd49436ea6bd3ca8296099ed46b6e4a4/20406984613.pdfIn PDF document text
    • https://catherinehourihan.art/wp-content/plugins/super-forms/uploads/php/files/11febf686d703a2cd8832d4b42f360f3/reloxibumirarip.pdfIn PDF document text
    • https://oncallanatomist.org/ckfinder/userfiles/files/81924131515.pdfIn PDF document text
    • http://dfwarbitrator.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/95419843863.pdfIn PDF document text
    • https://nnkcreations.com/userfiles/file/fujuzoxuwojolajagonazanik.pdfIn PDF document text
    • https://amenagementsoleil.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094bc8578462---jogaxegolosokovodu.pdfIn PDF document text
    • http://www.uppld.org/wp-content/plugins/formcraft/file-upload/server/content/files/16093b66c0bd59---gixirubupivudubaneze.pdfIn PDF document text
    • http://www.jesuseslaroca.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607dab6b05a89---84598601545.pdfIn PDF document text
    • https://greenturtleproductions.com.au/wp-content/plugins/super-forms/uploads/php/files/dcc28bf7ae53fe53798619fe084d5aff/kuxijetenegebotevaxut.pdfIn PDF document text
    • https://hotelritariccione.it/wp-content/plugins/formcraft/file-upload/server/content/files/160c18c01100e6---71002047007.pdfIn PDF document text
    • https://www.lesson-online.org/wp-content/plugins/super-forms/uploads/php/files/8dq9slfhurp5ko06khrojl8gi6/19061512174.pdfIn PDF document text
    • https://presstone.hu/userfiles/file/70060242593.pdfIn PDF document text
    • https://www.helpagesl.org/wp-content/plugins/formcraft/file-upload/server/content/files/160833b51c937c---xobufepowutom.pdfIn PDF document text
    • https://www.advids.co/wp-content/plugins/formcraft/file-upload/server/content/files/1609c619b9cc22---6703224899.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC8F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off000114a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x114A6 10744 bytes
SHA-256: f4f99078273ec88ea71bfbc9266ca8f6678d1ff3e5a0c636398ebeea867285e6
font_02_sfnt_off00012d70.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D70 16088 bytes
SHA-256: 450eea5fc67953cc3bdc764260aa6f1739571c17331c9588074966c3dbef4c6c
font_03_sfnt_off000142a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x142A1 17064 bytes
SHA-256: 5b159007274618d20e01a9a00301f087b1853b67e6aac7c1f76388b6e73de073

Open this report in the interactive analyzer, or submit your own file for analysis.