Malicious PDF — malware analysis report

Static analysis result for SHA-256 98d74a8e35e40939…

MALICIOUS

PDF

85.6 KB Created: 2021-08-24 06:22:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: f995978fbe0a47a0c1cd786d398d6a46 SHA-1: b43f962578d15876b56e1c3c2fdf28acf3cfd49c SHA-256: 98d74a8e35e40939246774111b9a3034a477c029bbd2d1437db9101501974b37
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous embedded URLs, many of which point to compromised WordPress sites using formcraft or super-forms plugins for file uploads. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The document body is heavily obfuscated, preventing a clear understanding of its direct lure, but the overall structure points to a link farm designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160a639a60d6a5---32533215359.pdf In PDF document text
    • https://www.businesswatchguardingservices.co.uk/wp-content/plugins/super-forms/uploads/php/files/bupgtcd4l4h74curtb6kvu98i8/subozexexijeguk.pdfIn PDF document text
    • http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c62b32fce8---nivuxezuvize.pdfIn PDF document text
    • https://www.medicalart.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160fd4f24a6cbf---buroniguzigawizixovevefog.pdfIn PDF document text
    • http://selfmadefilms.nl/userfiles/files/53651781265.pdfIn PDF document text
    • http://www.bestlifepolicy.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160adea00c5189---67458561235.pdfIn PDF document text
    • http://tremonttemplemacon.com/clients/862779/File/vekuz.pdfIn PDF document text
    • http://ersatzmonitor.de/userfiles/file/46181908558.pdfIn PDF document text
    • https://www.aironface.com/wp-content/plugins/super-forms/uploads/php/files/f5848d34c59c938295d77e58dac93dda/52808363098.pdfIn PDF document text
    • http://fixafilm.se/userfiles/file/jigaxagigev.pdfIn PDF document text
    • https://vico-domrep.com/ckfinder/userfiles/files/60338848002.pdfIn PDF document text
    • http://congtyvima.com/images/Download/70893901235.pdfIn PDF document text
    • http://hengtongrongshang.com/jingkelun/userfiles/files/20210804095929.pdfIn PDF document text
    • https://jbdclothiers.net/emailer/userfiles/file/xofumaludakal.pdfIn PDF document text
    • http://kasargod.net/uploads/file/xabatorelidurevozaw.pdfIn PDF document text
    • https://www.m2asolutions.com/wp-content/plugins/super-forms/uploads/php/files/0680bb65a387a2a18d2de24f03b3da00/darezufunesadil.pdfIn PDF document text
    • https://mvpartners.be/images/uploadedimages/file/vuvejexobopuba.pdfIn PDF document text
    • http://goldnumber.info/userfiles/file/88048798635.pdfIn PDF document text
    • http://dakmoto.cz/obrazky/file/nevalenonumezebor.pdfIn PDF document text
    • http://studiotecnicobonoli.com/userfiles/files/61199548689.pdfIn PDF document text
    • http://yogo110.com/userfiles/file/85406987942.pdfIn PDF document text
    • http://shssailors1969.com/clients/3/36/366f78b21138e0f8005dfe6cc5e09e30/File/ruwififeduzogubuku.pdfIn PDF document text
    • https://mygenius.ru/admin/ckfinder/userfiles/files/vawazimexexelo.pdfIn PDF document text
    • http://al-bandak.com/userfiles/file/kemetuku.pdfIn PDF document text
    • http://cinstech-inspect-survey.com/fckeditor_userfiles/file/81673886735.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/GLLx1DTH0VQ/uplcv?utm_term=a+discourse+on+inequality+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF86 1860 bytes
SHA-256: 562d39cc93351683f3420870a5578826c1285db13c691c08f99be18f4980e560
font_01_sfnt_off0000e838.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE838 17496 bytes
SHA-256: b6b6cb9f4be2102e9a7a902dfe1c0b5e0a9414d8f2e62e672a5268b088929376
font_02_sfnt_off000115e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115E3 10952 bytes
SHA-256: c28c680c14033bdc02c3a424a8b50026797899ebc0ddd3dd4b902e3602dce6ff
font_03_sfnt_off00012f43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F43 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.