Malicious PDF — malware analysis report

Static analysis result for SHA-256 93b3db3c38334a0e…

MALICIOUS

PDF

75.3 KB Created: 2021-09-04 10:15:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: f10fd4e32ac43a60a00e6f6343eac108 SHA-1: bd261722d10e8824307f9eccde460727eb1ebf1e SHA-256: 93b3db3c38334a0e107088b10d3d22ff307c3cda90debcb71a9815ec7461c619
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF was flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier, indicating malicious intent. It functions as a link farm, directing users to multiple compromised WordPress sites, likely to host phishing content or further malware. The presence of numerous external URIs and compromised CMS upload links strongly suggests a distribution or phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9939

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://thejasmineway.net/wp-content/plugins/super-forms/uploads/php/files/i60vq0p8qeis7ibja2fbfa5qc0/41110755703.pdf In PDF document text
    • https://wilsonbarrera.com/inicio/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca257b7e96---farotenoxovil.pdfIn PDF document text
    • http://donaldnathanlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/72684326265.pdfIn PDF document text
    • https://lokmangal.co.in/wp-content/plugins/super-forms/uploads/php/files/7c1260f36265f7298406b6cbb800823c/31473686054.pdfIn PDF document text
    • http://dambi.pl/userfiles/file/bomovamovumututifowamuges.pdfIn PDF document text
    • https://bowenpainter.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609d2d60ddc4a---xizudisijax.pdfIn PDF document text
    • http://cohensevents.com/clients/74638/File/gesamezidodujepemux.pdfIn PDF document text
    • https://xn-----6kcabagcgfjsxjciriy6alkh6a7aqk.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/1312e7db254a4735536829567f498762/bavokiset.pdfIn PDF document text
    • http://ziva-muzika.cz/files/file/sudamipewoj.pdfIn PDF document text
    • http://fine-cottage.ru/userfiles/file/84373516146.pdfIn PDF document text
    • https://chamsocmuihong.com/wp-content/plugins/super-forms/uploads/php/files/9rep3fns2eah88i0j2qe180njf/labosurolejixolage.pdfIn PDF document text
    • https://homini.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160b29de5acb5e---nawod.pdfIn PDF document text
    • http://bscartridge.com/pic/60682347687.pdfIn PDF document text
    • https://annjulieskarpmo.com/userfiles/file/nubagavasiraxabimem.pdfIn PDF document text
    • https://olterus.net/contents//files/kumuzop.pdfIn PDF document text
    • http://www.iso-clean.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160f754ee2f95f---putonizofiguz.pdfIn PDF document text
    • http://studio-orlandini.com/userfiles/files/95381744572.pdfIn PDF document text
    • https://burgas-remonti.com/userfiles/file/6982455564.pdfIn PDF document text
    • https://okinawa4d.com/contents/files/mozuxawufizosizopivaju.pdfIn PDF document text
    • http://www.leesii.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f8496a8bb8---92535624757.pdfIn PDF document text
    • http://print-printonline.com/ckfinder/userfiles/files/64662263519.pdfIn PDF document text
    • http://ig-einheitsloks.de/medien/file/gimujonixowegaperavonige.pdfIn PDF document text
    • https://sanipacific.com/attachment/file/75275126284.pdfIn PDF document text
    • http://recamonde.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c71462c088c---27954155976.pdfIn PDF document text
    • http://entone.es/wp-content/plugins/super-forms/uploads/php/files/44816e5fc38ab296125a05bd5fc444d8/datufelefatidi.pdfIn PDF document text
    • https://daaeportrett.no/upload/file/56812443357.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=translating+expressions+worksheetPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c5f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC5F8 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000de0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE0F 10776 bytes
SHA-256: c339ca0e5f765b0dc3ed0fdbe81edd343c7d3e678a90252dce49de05d1da5564
font_02_sfnt_off0000f6dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6DC 15764 bytes
SHA-256: 42ebee3600538ef781dcae1731247edfc0cac0bda59f6d97aa99fa36d7464638

Open this report in the interactive analyzer, or submit your own file for analysis.