Malicious PDF — malware analysis report

Static analysis result for SHA-256 914855d4ebec4bae…

MALICIOUS

PDF

84.6 KB Created: 2021-09-04 00:52:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 5dc010f2964384ccf5a42ccb02e7207a SHA-1: e18066f58e9145d0f466c370bd276b7b284fa4bf SHA-256: 914855d4ebec4bae4adab35f5ff617f2c5a66608a5e15fae08908ebc567a7e07
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous external URLs, many of which point to compromised WordPress sites or disposable hosting, suggesting a link farm designed to redirect users to malicious content. The presence of these links and the overall structure indicate an attempt to lure users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9945

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/uplcv?utm_term=schools+of+thought+in+philosophy+of+education+pdf PDF link annotation
    • http://amctop.com/board_data/editor_img/file/202106250844.pdfIn PDF document text
    • http://riversreunion.org/clients/8699/File/66207986069.pdfIn PDF document text
    • http://shinies.ru/img/lib/file/63875743913.pdfIn PDF document text
    • https://bdprescription.com/ci/userfiles/files/88823321514.pdfIn PDF document text
    • https://cursosadistanciayonline.com/medios//files/fijiguzuzanilaluladutaro.pdfIn PDF document text
    • https://www.popcaffe.it/wp-content/plugins/super-forms/uploads/php/files/311aeee91baf1ec47d20b60ceaca840c/53999321805.pdfIn PDF document text
    • http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b29c30d2223---siwudijubuwet.pdfIn PDF document text
    • https://www.davidcosz.de/wp-content/plugins/super-forms/uploads/php/files/1ei19r0v5bui1dpe8nltf55j7g/40845509224.pdfIn PDF document text
    • https://mziagroup.com/wp-content/plugins/super-forms/uploads/php/files/r54il16b3q1akc0r9ncd8ld4u5/60193834748.pdfIn PDF document text
    • https://kicksomeglass.com/wp-content/plugins/super-forms/uploads/php/files/70540ae1398db58934973b6cd8851869/xezatuwiverujekowosoz.pdfIn PDF document text
    • https://rmduncanrealty.com/userfiles/files/nogifogobakasemewotisele.pdfIn PDF document text
    • http://bortran.com/upload/image/file/20210513063830.pdfIn PDF document text
    • http://xn--42-6kcdlkbomh7beggito5p.xn--p1ai/userfiles/file/96703259588.pdfIn PDF document text
    • https://joyfool.art/wp-content/plugins/super-forms/uploads/php/files/bd7c5c647985f93075a233925aa6e191/fawufaxowojozixadazi.pdfIn PDF document text
    • http://www.theflightfest.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b11f48687f---69544665791.pdfIn PDF document text
    • http://kledingindex.nl/images/uploads/serusagasoganavadudaga.pdfIn PDF document text
    • https://atcotourismtravel.com/userfiles/file/47152993675.pdfIn PDF document text
    • http://arebiatours.com/uploads/files/43869432752.pdfIn PDF document text
    • https://rmdschoolandcollege.com/wp-content/plugins/super-forms/uploads/php/files/18372edc110f4b2a8cfafe7da6ba4c73/52627426599.pdfIn PDF document text
    • http://bougerpourstarlight.org/clients/c/c6/c668404594a1c08d975ab50c7bec58f6/File/28744321332.pdfIn PDF document text
    • https://thejinglelab.com/wp-content/plugins/super-forms/uploads/php/files/up45g6jgdr13s6rn3rjrqgpn68/majemaravevurefaxojot.pdfIn PDF document text
    • http://themultifold.com/wp-content/plugins/super-forms/uploads/php/files/kre6c2u0tmoa8jur4a11mmpnl3/32381423567.pdfIn PDF document text
    • http://klick-tipp.at/ckfinder/userfiles/publics/files/41592451967.pdfIn PDF document text
    • http://kwik-it.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160791969ef6f6---99111920464.pdfIn PDF document text
    • http://www.w3.org/1999/02In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec6e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC6E 11088 bytes
SHA-256: d93378164a6968ce3ee25ab382ec4e5ba3882e25e571f9c2ee7afca145279a7b
font_01_sfnt_off0001060b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1060B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00011e1d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E1D 17360 bytes
SHA-256: 71bfa52b1df5ececc554964693feb077d9f019a2f701c0dcff50ae39e9cb635d

Open this report in the interactive analyzer, or submit your own file for analysis.