Malicious PDF — malware analysis report

Static analysis result for SHA-256 97b395d7a4b97e71…

MALICIOUS

PDF

85.7 KB Created: 2021-09-03 14:15:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 38f05df7e599716443b665c840d172d2 SHA-1: b1dc0a11e7b245a0cb06ba3a9f8669a63980d7a5 SHA-256: 97b395d7a4b97e71d3ce840146b3f1e2c749cd95f958329a9124e9a1b6dceedf
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a large number of links, many of which point to compromised WordPress upload storage or disposable hosting, indicating a link farm designed to distribute malicious content or phish users. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://happycolaborativo.com/uploads/files/27886638264.pdf In PDF document text
    • http://dentherapia.hu/files/file/razopilif.pdfIn PDF document text
    • https://www.traitagri-solutions-alternatives.fr/ckfinder/userfiles/files/40215385829.pdfIn PDF document text
    • http://austria-ex.com/images/blog/file/kofiziwepunubukopup.pdfIn PDF document text
    • https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/b29c3c8ee2857ff5d4e4780b30ad3e14/46691819363.pdfIn PDF document text
    • https://www.areatransfers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607861b0227b8---20287677281.pdfIn PDF document text
    • https://earthideasawnings.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d97b5a8c3a---lakigemarisegarerave.pdfIn PDF document text
    • http://hz-kontejnery.cz/ckfinder/userfiles/files/welijuritoje.pdfIn PDF document text
    • http://davidhammerstein.org/userfiles/file/30652159932.pdfIn PDF document text
    • https://www.reliancecareuk.com/wp-content/plugins/super-forms/uploads/php/files/9d7b5b39e33ebd3d2f8960a42c96ca3c/87207221646.pdfIn PDF document text
    • https://educhina.mn/editor/files/26817002506.pdfIn PDF document text
    • http://www.caslyn.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1608e58c68fe2b---47833517642.pdfIn PDF document text
    • https://endoaccessories.com/wp-content/plugins/super-forms/uploads/php/files/59ectutq82ufuolbndser9fk8b/jeranizezovaz.pdfIn PDF document text
    • https://bf-pomosch.ru/wp-content/plugins/super-forms/uploads/php/files/mpfaftnritq68p00k9t11mcph3/novutofoterubifuduz.pdfIn PDF document text
    • https://tradingphrases.com/userfiles/files/judapaligebewutipupumizex.pdfIn PDF document text
    • https://chamsocmuihong.com/wp-content/plugins/super-forms/uploads/php/files/dhmdu1pp85j15n364u5cq0pgt8/27292113394.pdfIn PDF document text
    • http://www.gunyagder.org.tr/wp-content/plugins/super-forms/uploads/php/files/sm34ful8obi1ns8uqrjbt4vd94/miwotomefani.pdfIn PDF document text
    • https://paroles-vives.com/ckfinder/userfiles/files/18707805652.pdfIn PDF document text
    • https://badrivishal.com/media/488248309.pdfIn PDF document text
    • http://nbkhjc.com/uploads/202108/file/2108041936091621591f6jl9bb46g3.pdfIn PDF document text
    • http://mijneigenlift.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16082c34e3a39a---dozujo.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b919db4a1ae---moxulasowiteb.pdfIn PDF document text
    • http://adabaskimerkezi.com/upload/file/vixizopopog.pdfIn PDF document text
    • http://altaprecision.com/userfiles/file/zatuwamajixoloxereki.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=harga+avanza+2015+type+g+manualPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e927.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE927 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0001013e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1013E 10976 bytes
SHA-256: 8c60d6ad3a57cbe50944b698e875a70f89efb20d87baf7a1372658f268245945
font_02_sfnt_off00011ae2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11AE2 17844 bytes
SHA-256: 1f22980c108a2b59a60b48f0f0095bff48bbe2fece46b0e06c5689753d5f2257

Open this report in the interactive analyzer, or submit your own file for analysis.