Malicious PDF — malware analysis report

Static analysis result for SHA-256 990edf19ea19e79f…

MALICIOUS

PDF

93.3 KB Created: 2021-07-31 04:30:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: 9e8ba10fc9f76504c9d64fddae160963 SHA-1: 3b4331595f375b9315786c8a6201c9624ae4ce10 SHA-256: 990edf19ea19e79ffcb0816311a1a3b8925f0d790ae210c013be016c507926a8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier as malicious. It contains a link farm pointing to multiple compromised WordPress upload directories and other disposable hosting, suggesting an attempt to distribute malicious content or phish users. The presence of external URIs and a link farm indicates a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9914

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://primax.fr/wp-content/plugins/super-forms/uploads/php/files/4kdsivfb8o1026q49f8ldrabf5/bapuzulesizi.pdf In PDF document text
    • http://busankid.com/webfiles/board/file///denalezeri.pdfIn PDF document text
    • http://shuswapladystriders.ca/userfiles/file/fufisisijidopadad.pdfIn PDF document text
    • http://kaztelcom.kz/ckfinder/userfiles/files/73552975324.pdfIn PDF document text
    • https://sygimportaciones.com/wp-content/plugins/super-forms/uploads/php/files/26h7ttjpvfhdf6s496jvf2khak/48820577416.pdfIn PDF document text
    • http://churchtextile.com/userfiles/file/kuzugur.pdfIn PDF document text
    • https://ceilford.org/wp-content/plugins/super-forms/uploads/php/files/6586412113d1479cc21049177d2f9011/77633384407.pdfIn PDF document text
    • http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/160c2fca565bf2---27779453823.pdfIn PDF document text
    • https://thehamptonsbloomington.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078332876af8---3541209954.pdfIn PDF document text
    • http://sts-logistika.ru/wp-content/plugins/super-forms/uploads/php/files/1c8716ff0a3cd56ddec94e92bc3a304e/96719115607.pdfIn PDF document text
    • https://www.vigo.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1608829a258c37---42648593947.pdfIn PDF document text
    • http://hongdacable.com/d/files/3779950277.pdfIn PDF document text
    • https://lion-trading.co.uk/wp-content/plugins/super-forms/uploads/php/files/lqir579o28vsjponf6flusj0u2/20025782980.pdfIn PDF document text
    • http://bizbecho.com/pa/trainstation/uploads/image/file/25600722160.pdfIn PDF document text
    • https://nstoplana.rs/ckfinder/userfiles/files/35846146972.pdfIn PDF document text
    • https://atlastoursntravels.com/userfiles/file/rufipupamedusepanezukaj.pdfIn PDF document text
    • http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f10e70e658---94816062907.pdfIn PDF document text
    • https://lokmangal.co.in/wp-content/plugins/super-forms/uploads/php/files/38819186b14e3848ab21876a0cd7f0c7/vegiziferapi.pdfIn PDF document text
    • https://ghadir-eng.com/userfiles/files/ruvowugufezo.pdfIn PDF document text
    • http://liddellgaryfamily.com/clients/863293/File/62372494226.pdfIn PDF document text
    • http://veronicanealhome.com/wp-content/plugins/formcraft/file-upload/server/content/files/2/16070973f794a9---95465098249.pdfIn PDF document text
    • http://herve-coiffure.ci/files/68535575243.pdfIn PDF document text
    • http://driver-jazda.pl/upload/file/dofegalinam.pdfIn PDF document text
    • http://bomtvplus.com/data/board/file/20210514204300.pdfIn PDF document text
    • http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/16100bd9138fbf---27680937098.pdfIn PDF document text
    • https://divorcioconsensual.com.br/wp-content/plugins/super-forms/uploads/php/files/1d917389d32374e3870b9014a02625a4/pazelilorakin.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=how+to+setup+mic+on+onkyo+receiverPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1DB 16084 bytes
SHA-256: c27fafdda185be2695e99106f22849c7304d1d4eff2202c3575f3979fbde09eb
font_01_sfnt_off0001070c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1070C 17364 bytes
SHA-256: 5fbbf6cdbdcd6af1f59a359df47bec6130d95044090def9533fc7a815634aa35
font_02_sfnt_off000134b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134B1 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00014cc8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14CC8 10776 bytes
SHA-256: 1bd8629b6a90337be34f2b9c3e2b372926e55bb4f0ad5ad915a315d215f426aa

Open this report in the interactive analyzer, or submit your own file for analysis.