Malicious PDF — malware analysis report

Static analysis result for SHA-256 9948613b96508d5f…

MALICIOUS

PDF

90.3 KB Created: 2021-07-18 09:19:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: e687b7f9a45bd2b2cc011e0cae0f877d SHA-1: 5f3f48e5a9bedf31e32864342f7d4ab4ac6498c4 SHA-256: 9948613b96508d5f2ba2a10ab162cab5f09d8c03f784ab4ee04f645c63e1e1c9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Heuristics identified it as a link farm hosted on compromised CMS uploads, pointing to numerous external URLs. The presence of multiple PDF link farm indicators and the use of compromised WordPress uploads strongly suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9924

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://monarchwinemerchants.com/wp-content/plugins/super-forms/uploads/php/files/d111c9b38616df1fda340061af38a2f9/nutatipiv.pdf In PDF document text
    • https://beaumont-residence.com/wp-content/plugins/super-forms/uploads/php/files/lin5nver2hbrrk9vs5tfg91kdd/feredosorirofel.pdfIn PDF document text
    • http://geology.ie/wp-content/plugins/formcraft/file-upload/server/content/files/160f38350c71d7---10660581583.pdfIn PDF document text
    • http://www.appsolutely.sg/wp-content/plugins/formcraft/file-upload/server/content/files/16083e7832c1dd---nilaguxape.pdfIn PDF document text
    • https://an-professional.ru/img/files/file/wadop.pdfIn PDF document text
    • http://emotionpicturesfestival.gr/userfiles/file/93145004067.pdfIn PDF document text
    • https://www.adelaarenergy.com/wp-content/plugins/super-forms/uploads/php/files/a23tedrkuf647bkotj9766gdqr/muponeb.pdfIn PDF document text
    • http://www.biotanika.pl/upload/file/kopabarodas.pdfIn PDF document text
    • http://feynburg-uhren.de/uploads/degonapubesovasagibi.pdfIn PDF document text
    • https://avenirpourtous.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16070333039d1e---wifeguxofedunilidewo.pdfIn PDF document text
    • https://vizzzio.ru/wp-content/plugins/super-forms/uploads/php/files/d5327ff886c43348031e4a48c9f8782a/83354868791.pdfIn PDF document text
    • http://www.iqubz.com/wp-content/plugins/formcraft/file-upload/server/content/files/160928db89f0a1---luzipoximabazekedisusokeb.pdfIn PDF document text
    • http://birkhoffhi.com/userfiles/files/mifeteg.pdfIn PDF document text
    • https://pypconsultores.mx/userfiles/file/tenulodiromusoresulubub.pdfIn PDF document text
    • https://dangeloremodeling.com/nbloom/fckuploads/file/nobuvula.pdfIn PDF document text
    • https://www.arc-welding.co.uk/wp-content/plugins/super-forms/uploads/php/files/nr9gc1860jln0lvfeul8p0vjbq/bofegixavokurodi.pdfIn PDF document text
    • http://sb-78.ru/files/file/41046280925.pdfIn PDF document text
    • https://atlanthealth.com/wp-content/plugins/super-forms/uploads/php/files/a66373a7ced5820f1c9507b99ce08fe3/15325425440.pdfIn PDF document text
    • https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160c70a8797d08---44117374135.pdfIn PDF document text
    • http://sibinetweek.ru/userfiles/file/11585566222.pdfIn PDF document text
    • https://auto-rujo.com/images-editor/file/pewiwadita.pdfIn PDF document text
    • https://www.frankreich-ferien.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1608a79e24ef3f---zetizukuz.pdfIn PDF document text
    • http://jhferry.com/data/fckeditor/file///21351604354.pdfIn PDF document text
    • http://travellightnepal.com/userfiles/file/vupowapovijoje.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=verb+to+be+itPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e433.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE433 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000fc44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC44 17572 bytes
SHA-256: 06f5d9ee3516b60e6dc3de35d309a96299fe87ae00885c88cbb24272c09b7aa3
font_02_sfnt_off000116a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x116A1 17788 bytes
SHA-256: 141716535489afac9517bf3ec1bc1a4937c8c3c992ddbb9272882f9714accf05
font_03_sfnt_off000144c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x144C8 9728 bytes
SHA-256: afbbd1c21f6044c6a1f40d2ac8600ddb0689ed150a661113ec8da0baaa6d1aaf

Open this report in the interactive analyzer, or submit your own file for analysis.