Malicious PDF — malware analysis report

Static analysis result for SHA-256 88364d7b3dcc6d8f…

MALICIOUS

PDF

81.4 KB Created: 2021-09-01 08:15:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-23
MD5: 06a35a0aab664f9f610dc64c27010f29 SHA-1: 3bffdbc2fc10f340ca59bd673d7ee36025d353ea SHA-256: 88364d7b3dcc6d8fc4ef2c6c3fbf70c6ca0c6feb1b85d345f80d826404860da5
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file is a PDF that contains numerous links to compromised websites, many of which are associated with form upload vulnerabilities. The presence of a 'download button' heuristic and the ML classifier's high confidence score indicate a malicious intent to trick users into downloading further malicious content. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://arichaindia.com/userfiles/file/nejenijeredesalezul.pdf In PDF document text
    • http://clinicaveterinariaalbese.eu/userfiles/files/sopifezajapaxon.pdfIn PDF document text
    • https://bhsbeacon.com/FCKeditor/file/53744351149.pdfIn PDF document text
    • https://www.xcelsus.de/wp-content/plugins/formcraft/file-upload/server/content/files/160e25c9c269c2---94475566776.pdfIn PDF document text
    • http://ever-pioneer.com/upload/files/44084642997.pdfIn PDF document text
    • http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1607198294f17e---najazovenifoxop.pdfIn PDF document text
    • http://famcareconnect.org/wp-content/plugins/formcraft/file-upload/server/content/files/16070f81f24d46---69362619212.pdfIn PDF document text
    • https://www.surajinformatics.com/wp-content/plugins/super-forms/uploads/php/files/7a5ddbd97454d3e614f8439c50d23b1e/tikaxesiku.pdfIn PDF document text
    • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/3kmts7mp9n3kgghjgefk9v5kd6/75959665518.pdfIn PDF document text
    • https://hotel-la-licorne.fr/userfiles/file/jiligawadapatiji.pdfIn PDF document text
    • https://centrobrands.com/wp-content/plugins/super-forms/uploads/php/files/d90e9910e05a158c321a03f99e1bc0a9/bufigebetazifoxo.pdfIn PDF document text
    • http://fine-cottage.ru/userfiles/file/fumibig.pdfIn PDF document text
    • http://timandlor.com/userfiles/file/84908395607.pdfIn PDF document text
    • https://conexusinternational.com/ckfinder/userfiles/file/96159787013.pdfIn PDF document text
    • https://habibitours.com/ckfinder/userfiles/files/32899818125.pdfIn PDF document text
    • http://www.grupohk.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16093277ac68a4---mifosudamok.pdfIn PDF document text
    • http://www.acefence.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3fa2c7c9f6---jetovoguzemo.pdfIn PDF document text
    • https://fluffy-chins.com/images/file/1748655023.pdfIn PDF document text
    • http://quocteanviet.com/img-chamthi/files/lokufinirixemex.pdfIn PDF document text
    • https://beautydiction.com/ckfinder/userfiles/files/bimezerotiwiluvebe.pdfIn PDF document text
    • https://tangentemag.com/img/file/nidopadojuxoku.pdfIn PDF document text
    • http://www.kreasoft.mx/wp-content/plugins/formcraft/file-upload/server/content/files/16075994285a9b---dosizimatuwarimowatej.pdfIn PDF document text
    • http://fixmyhelicopter.com/project-new/christianbook/upload_images/file/bapukarazunugogifafip.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=open+university+entrance+exam+model+papersPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d63d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD63D 11084 bytes
SHA-256: 7a3173eab740fbb9ddbe7dd0e4d72fd798a9f8adee6939e4fa5c8f358955de86
font_01_sfnt_off0000f030.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF030 18424 bytes
SHA-256: 12e4b8fdaf32e11e31e122804852b621e04f261959a0c927ed40d5b6d5912f78
font_02_sfnt_off00011ede.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11EDE 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.