Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c4008d146638da3…

MALICIOUS

PDF

90.0 KB Created: 2021-07-28 08:12:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: e4dfe7496d80b8375d3f6d4d312e208f SHA-1: 8df1cc9f688cb6a9f610c721c86b5e6eea8e7e8c SHA-256: 9c4008d146638da31774823aeef5f6a17fbffe4ffe1090a2266bbdfc4e18d3b2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by ClamAV as a phishing trojan and ML classifiers indicated maliciousness. It contains numerous links, many pointing to compromised WordPress sites, suggesting a link farm or redirection scheme. The document body is heavily obfuscated and unreadable, preventing a deeper analysis of its specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9777

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.lavalledesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094dee228905---22747952371.pdf
    • https://www.bluegreenshouseboats.in/wp-content/plugins/formcraft/file-upload/server/content/files/1607dcd2c94334---lilurub.pdf
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/bq72eskajk37bmbkrnbf23otb0/damokidekudifidito.pdf
    • http://getawaynewzealand.co.nz/wp-content/plugins/formcraft/file-upload/server/content/files/160fa3fefc2f70---texaterijuk.pdf
    • http://phillipsbrothersmill.com/clients/6/65/65192871cce8a6e36080a9ebd2808b02/File/pezulabofujokoba.pdf
    • https://binarbaid.com/public_html/userfiles/file/fobagaxutusuti.pdf
    • https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/38e61e09b045833b743a1cb8dae3e72c/dusenosoro.pdf
    • https://mls.lighting/wp-content/plugins/super-forms/uploads/php/files/8302145561da97ff8a77b794ba004dd2/delizemezeponoramiwi.pdf
    • http://www.asslar.de/downloads/suneru.pdf
    • http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d01d33094c---xuxidasivunanu.pdf
    • https://contactfm.be/userfiles/files/99730223059.pdf
    • https://pmeds.us/userfiles/file/61511874501.pdf
    • https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/05d6b3f4ed2eaa90272f2730e0cfa06c/pawunolojufap.pdf
    • https://agatanorek.com/files/file/79803193797.pdf
    • http://maidichike.com/upload/files/samuposes.pdf
    • https://digireg.cn/upload/bixam.pdf
    • http://rencontres-icare.org/userfiles/file/86987144461.pdf
    • http://www.sarajevo-inn-grunewald.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609445c331cdd---bokunozakegisivilo.pdf
    • https://mytutr.com/wp-content/plugins/super-forms/uploads/php/files/ffb70223abc9624de9f1956dfa6d6c92/xituxufuvudelowikivuselep.pdf
    • http://cosmeticdermatologymiamibeach.com/uploads/data/files/96163617473.pdf
    • https://proff-doors.ru/wp-content/plugins/super-forms/uploads/php/files/5d4a88c5db68b7821046cc2db6948b01/vupetawi.pdf
    • http://www.peplex.it/wp-content/plugins/formcraft/file-upload/server/content/files/160f534049da24---31728927093.pdf
    • http://shmountaineering.co.uk/wp-content/plugins/super-forms/uploads/php/files/4qh4he01piqo8t7qnpmfegmg91/52100046276.pdf
    • http://studiospazioambiente.it/userfiles/files/36054401434.pdf
    • http://www.sarajevo-inn-grunewald.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6af431fc9d---rareb.pdf
    • https://seroinstitute.com/wp-content/plugins/super-forms/uploads/php/files/e46f9d6cdd826bb9583114a8c278a6ae/kajunoputajonurupiji.pdf
    • http://www.cheapmotorcycleinsurancepa.com/wp-content/plugins/super-forms/uploads/php/files/f1q5dha1fafb74jga3planpc92/55570308513.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=qkk+mini+projector+connect+to+iphone
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f303.bin
83a625d50b62687a7b4e152752e32d6b2500e4c872113cee435348aa4b28c1a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF303 17672 bytes
font_01_sfnt_off00012194.bin
0a4af374cb035e676210909e4790276a619635896d879aefac6ffd5912e9aefa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12194 1668 bytes
font_02_sfnt_off00012988.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12988 16792 bytes
font_03_sfnt_off0001419f.bin
f6b5a2396cf6e90f89fe8283af74995f408ba8fd1ba04abf5710aa9da1120033		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1419F 10544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.