Malicious PDF — malware analysis report

Static analysis result for SHA-256 93675370b88eba20…

MALICIOUS

PDF

112.4 KB Created: 2021-06-27 21:18:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: 2772da38f72ce71c9b258d6ecefc8e67 SHA-1: 28ed67bf5e69c91c07afc23a41b68b36da312784 SHA-256: 93675370b88eba20930d4505a923f08aa856b55c5d409d28e803be0db4a915db
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, containing numerous URLs that point to other PDFs hosted on compromised websites, suggesting a multi-stage attack or phishing campaign. The presence of external URIs and link farms on disposable hosting further supports its role in distributing malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9792

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/91f8540b0f1d18566d09aa7a443e3e65/75949669735.pdf In PDF document text
    • https://drmiamiconnect.com/wp-content/plugins/super-forms/uploads/php/files/b42b4d0bbeb6d4c4d5690ca2e4b52dae/43510466654.pdfIn PDF document text
    • https://108pizza.pl/uploads/userfiles/files/18037328274.pdfIn PDF document text
    • http://www.k-24.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b8e24937958---62629440862.pdfIn PDF document text
    • https://wholisticvibrations.com/wp-content/plugins/super-forms/uploads/php/files/b25228719f47af83d0e82cb15b4d567b/giwawujunoj.pdfIn PDF document text
    • http://www.tsssport.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d4f408b620c---74030678866.pdfIn PDF document text
    • https://mariellatriolo.it/public/file/buwatisita.pdfIn PDF document text
    • http://progfin.pl/userfiles/file/71730149032.pdfIn PDF document text
    • https://a1-recruitment.fr/v2011/Files/fck_upload/file/gipagifopati.pdfIn PDF document text
    • https://www.hdcorp.com.br/wp-content/plugins/super-forms/uploads/php/files/ujv5ujcruu402sr445hva2dnpm/pategobe.pdfIn PDF document text
    • http://thedreams.cz/files/zosejikisokorolagiwuze.pdfIn PDF document text
    • http://www.davidwoodpersonnel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b764fc29aee---tivesufo.pdfIn PDF document text
    • https://fmpride.com/wp-content/plugins/super-forms/uploads/php/files/357d366a5acad83fa1de448a3f18d400/zelowi.pdfIn PDF document text
    • https://travelstore.tn/userfiles/file/kakedufajirenugowa.pdfIn PDF document text
    • http://studioarchperissinotto.eu/userfiles/files/lolowoxogi.pdfIn PDF document text
    • https://angkoronetour.com/userfiles/file/82772144786.pdfIn PDF document text
    • https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607db1da93d07---5888501722.pdfIn PDF document text
    • http://enjoy.sk/editor_uploads/system/files/62062203850.pdfIn PDF document text
    • https://www.peeryhotel.com/wp-content/plugins/super-forms/uploads/php/files/4381b99665403624c57875bb50dab28b/vuluralotumuduxaj.pdfIn PDF document text
    • http://akssert.com/userfiles/files/63031620535.pdfIn PDF document text
    • http://eviljoy.com/UserFiles/File/68605897903.pdfIn PDF document text
    • http://countrysquirefoods.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078877a7cbaa---24680877504.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=north+west+facing+apartmentPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012df5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DF5 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00014607.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14607 18576 bytes
SHA-256: 3e72d73535eea0bd8a85005e8ad06b181c5c82cee60ec570f317d0bb6848b6c8
font_02_sfnt_off00017500.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17500 1940 bytes
SHA-256: 47e5b44841a38706c598245e50e4c258d2dafb70d656caa4b88d08a384162a50
font_03_sfnt_off00017dfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17DFD 18112 bytes
SHA-256: 28a92a901c73ffd04168374a16009673460a3f5fbb5dee95384322748dbcc42f
font_04_sfnt_off00019a4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19A4F 10944 bytes
SHA-256: e45c339990051c89cf79f7c52f666b58c63e87510147bf0485024cc5fafa2847

Open this report in the interactive analyzer, or submit your own file for analysis.