Malicious PDF — malware analysis report

Static analysis result for SHA-256 95b137409faf5c5c…

MALICIOUS

PDF

93.5 KB Created: 2021-07-02 00:04:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: c7fb97a0553ccfbcc29f35ba7961b490 SHA-1: 4944ddabb49c07ff02057af57f3b4a48872fe937 SHA-256: 95b137409faf5c5cc54b292a770e7dfbf50b1ccd80e8d228bdbf6c7b43b9e30c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Heuristics identified it as a link farm pointing to compromised WordPress upload storage and disposable hosting, suggesting a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9924

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://conwaychristian.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c0682a1a95a---kuxoravujufegiwa.pdf
    • http://sarlampa.ru/upload_picture/46025679351.pdf
    • https://robotics-institute.com/wp-content/plugins/super-forms/uploads/php/files/jamshn977e6d7krg90ud575q5c/38670378946.pdf
    • https://www.diktu.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608fb3ded1cf7---bipudigafew.pdf
    • https://www.andimoda.com/wp-content/plugins/super-forms/uploads/php/files/21b389a03d0f9790a16261e01bc3a4f2/zorizuzuwupapejo.pdf
    • https://hoffmanowska.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1609cefda7e627---17133285879.pdf
    • https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab17b58a6dc---69652714539.pdf
    • https://www.saenger-ohg.de/wp-content/plugins/formcraft/file-upload/server/content/files/160b9bb80a1a10---95339381203.pdf
    • https://adepotcustom.com/UploadFiles/file/20210610190941171.pdf
    • https://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/0cb6fad4b325291042ba6be11f6f0ab8/21463066856.pdf
    • https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160895de415b8f---xumuwovid.pdf
    • http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607f8b3dee8ee---10984919290.pdf
    • http://jingluo.net/uploadfiles/files/17181118075.pdf
    • http://evolutionchonburi.com/userfiles/files/duwefokaf.pdf
    • http://zjhywt.com/images/upload/File/vatuvajifek.pdf
    • https://semagro-msw.ru/pics/images/file/gutit.pdf
    • https://www.baptistenhardenberg.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a3a92f70ef5---60391105100.pdf
    • http://thehawthornnyc.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077932029e65---41977172692.pdf
    • https://yuss.it/file/99601426209.pdf
    • https://www.elitelawnsolutions.co.uk/wp-content/plugins/super-forms/uploads/php/files/ad9kbsg0o2l7q3pbg2jusm3lmb/jigaredowizu.pdf
    • https://area34.info/wp-content/plugins/super-forms/uploads/php/files/lplsi9p2k7dj1ijv3obertlau1/xazok.pdf
    • http://stylist.in.ua/wp-content/plugins/formcraft/file-upload/server/content/files/160cb001dbf20c---malivesu.pdf
    • https://envomask.com/wp-content/plugins/super-forms/uploads/php/files/6bbfcd02a02d912a4f2a9335d7be4169/jixabowadavulaluko.pdf
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a767dd861be---lofelel.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=hentai+rpg+games+android
    • http://lovewhereyoulv.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/c66372c596432aa4e86166eef73b3539/putujeke.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f32c.bin
20f9a40c63602742bea16d45a1bd74f4ef794e7624f177dfb1a7ad2ce7a4cc8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF32C 17516 bytes
font_01_sfnt_off00012105.bin
97e3f73a58ccdd4784c9ae1678d9f90717e6b6d0c87c36bf93adb8865ef65ebd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12105 16192 bytes
font_02_sfnt_off00013691.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13691 16792 bytes
font_03_sfnt_off00014ea8.bin
0fa822992be67af71c106ec0189538a782a6ee58ae4b1a99296186f9bdfb4a74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14EA8 10680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.