Malicious PDF — malware analysis report

Static analysis result for SHA-256 919363e3c5d25009…

MALICIOUS

PDF

88.2 KB Created: 2021-07-28 06:02:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-13
MD5: 1ab6d13d5e8567c566cf9f15e3b2367e SHA-1: cc6b943523a8c7b67162b410fe21683c46bba17d SHA-256: 919363e3c5d2500936e25eae67059f6dc26e00e9111fa0c2898e9e2d0074eab8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics as malicious, including a ClamAV detection for 'Pdf.Phishing.Trojan'. The document functions as a link farm, containing numerous URLs pointing to compromised WordPress sites and potentially disposable hosting. These links likely serve to redirect users to phishing pages or other malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vizzzio.ru/wp-content/plugins/super-forms/uploads/php/files/f3cfb3053e88ec7c9a968035acf4c9f8/zonezi.pdf In PDF document text
    • https://unitedcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607115254f36b---11563941337.pdfIn PDF document text
    • https://www.opdrrustukalac.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607afe4add659---vibodulupejunitonaf.pdfIn PDF document text
    • https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/7i31q4amq84g6aulvr573ajd7b/67591424780.pdfIn PDF document text
    • http://bartuceviri.com/userfiles/file/dokerojapix.pdfIn PDF document text
    • https://amenagementsoleil.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ce70407202---62652803601.pdfIn PDF document text
    • https://personalloan2u.com/wp-content/plugins/super-forms/uploads/php/files/3b2d74453cc61a8ae10fc21c78283a0b/fibakipa.pdfIn PDF document text
    • http://vivaldiskibus.com/FileData/ckfinder/files/20210703_5E4FF4F8E59237B4.pdfIn PDF document text
    • https://rmdschoolandcollege.com/wp-content/plugins/super-forms/uploads/php/files/1aft2q1k7oomhhpt68sprtf8g2/kozaweluwarotevozirab.pdfIn PDF document text
    • https://theemperorsoldclothes.co.uk/wp-content/plugins/super-forms/uploads/php/files/ojtr3quriodgfucgimk65stagp/35667639639.pdfIn PDF document text
    • https://music-group-store.com/upload/files/fopazegiwamubun.pdfIn PDF document text
    • https://tomas-music.com/contents//files/viruzevilolexu.pdfIn PDF document text
    • https://vdbergelectro.nl/wp-content/plugins/super-forms/uploads/php/files/43d1edb784cea88c18eb5d88a99bf787/87178785346.pdfIn PDF document text
    • http://pelesiuvalymas.lt/i/File/62925221101.pdfIn PDF document text
    • http://makingtheturngolf.com/clients/9/92/925d9bae4ecf380f28dbe0e1390c16eb/File/lawunoramomima.pdfIn PDF document text
    • http://subventionsbetrug.de/wp-content/plugins/super-forms/uploads/php/files/o7u20coo57k2pfg1qcp367l1uh/piterimofinijijexowigejo.pdfIn PDF document text
    • http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/19tcs47d4ur68uadifgi6d7tl5/rotofafowigijekivamuxam.pdfIn PDF document text
    • https://hps-gruppe.com/wp-content/plugins/super-forms/uploads/php/files/cipgoc4cfif2jmkaqq9204mguc/15503144111.pdfIn PDF document text
    • https://burlingame.com/wysiwygfiles/file/viludiwejetugevufuboxak.pdfIn PDF document text
    • http://ganan10.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16078a31a96347---buvitadek.pdfIn PDF document text
    • http://zpb-maciejewski.pl/upload/fck/file/xojofajinunuvowogexekavo.pdfIn PDF document text
    • https://www.heainc.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d81bca0beec---pexemituvubaguzupifulib.pdfIn PDF document text
    • https://pt2-turbo-j3t.com/contents//files/65899921708.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=web+design+tutorial+pdf+freePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3C8 10908 bytes
SHA-256: 11726b83d2d03e31716f2b5d6e13121dadbc0f101917ab791728f710dd4f9c4f
font_01_sfnt_off00010cba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CBA 17372 bytes
SHA-256: 92e3d5aef83982f0cdba65356de4a11ee33e5801dc45b81d056bcfdc4a141794
font_02_sfnt_off00013a43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13A43 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.