Malicious PDF — malware analysis report

Static analysis result for SHA-256 98b3e155972392e4…

MALICIOUS

PDF

80.6 KB Created: 2021-09-01 00:11:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 12e04f780aaba4a9ebcb1265652f4a57 SHA-1: 88e49edd453492d734394c393a9bad53e69909b4 SHA-256: 98b3e155972392e4cdf9fa635dd8fb63d22cd21c0bfa68740ae91b144b4a1478
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics as malicious, including a high-confidence ML classifier and ClamAV detection. It contains numerous links to external websites, many of which appear to be part of a link farm hosted on disposable or compromised domains. The primary function appears to be directing users to potentially malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pistant.ru/uplcv?utm_term=real+analysis+by+sk+mapa+pdf PDF link annotation
    • http://jnnycc.org/userfiles/file/wusudelokajavozedel.pdfIn PDF document text
    • https://10playsolutions.com/clients/softklk/documents/_articles_/file/56441133376.pdfIn PDF document text
    • https://aawyx.com/sites/default/imageuser/file/sazugemewadaxole.pdfIn PDF document text
    • http://www.icodar.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cac1c200d6e---senigafojupumaxodaf.pdfIn PDF document text
    • https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/eo5fg108kbio6b4if2c564nqpv/23046124865.pdfIn PDF document text
    • https://www.makathastaliklari.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607c1babb7cd9---xekurabanamakeridubosan.pdfIn PDF document text
    • https://www.tai.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160903c77ab18d---35755984590.pdfIn PDF document text
    • http://kino-profi.com/wp-content/plugins/super-forms/uploads/php/files/33b6974e9138ff3e6c8779ae9e381350/babas.pdfIn PDF document text
    • http://floridare.ru/app/webroot/img/uploads/file/305705_godurajam.pdfIn PDF document text
    • http://www.rify.us/cms-uploads/files/8627104253.pdfIn PDF document text
    • http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607127b37701f---43236523840.pdfIn PDF document text
    • http://www.melodypods.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089c24d3030f---xinuri.pdfIn PDF document text
    • http://sanarina.de/ckfinder/userfiles/files/52003258510.pdfIn PDF document text
    • https://www.avenueroadadvertising.com/wp-content/plugins/formcraft/file-upload/server/content/files/160fbe5b20f458---20319177602.pdfIn PDF document text
    • http://asalsold.com/wp-content/plugins/formcraft/file-upload/server/content/files/160afd3b480643---75778698343.pdfIn PDF document text
    • https://event-connections.net/wp-content/plugins/formcraft/file-upload/server/content/files/160929f7b0e656---tusax.pdfIn PDF document text
    • http://kompletucetnictvi.cz/files/file/redorutisalozekurivabinuz.pdfIn PDF document text
    • http://wacommerce.net/home/integrity/public_html/ckfinder/userfiles/files/vibiz.pdfIn PDF document text
    • http://hainescentreasia.com/images/file/52494422574.pdfIn PDF document text
    • https://maloneslandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a85f338c7db---wigapejerubu.pdfIn PDF document text
    • http://abwlondonblvd.com/uploads/files/19818626350.pdfIn PDF document text
    • https://siangyun.com/upfiles/editor/files/70260354600.pdfIn PDF document text
    • http://www.sphotobooth.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d150289c42---60242694320.pdfIn PDF document text
    • http://lyshiying.com/d/files/76157643552.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d4d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4D5 17868 bytes
SHA-256: 553eccc5ad96a3c9b1bbf83cb9a8897fddb4fa6a33c64591a4175d4939e6d3bc
font_01_sfnt_off0001038f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1038F 10732 bytes
SHA-256: 1fc65f4780bfd45d5433837cde82a88289105089dbafd505d49370abadea77d8
font_02_sfnt_off00011bf1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11BF1 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.