Malicious PDF — malware analysis report

Static analysis result for SHA-256 9cdb4d900e8d4941…

MALICIOUS

PDF

91.1 KB Created: 2021-07-02 10:49:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: b0adadd6a0a010b5515fa565bd0e0517 SHA-1: 754744d4c7ebbc101aa9291bb5cc29cef9ccd7a1 SHA-256: 9cdb4d900e8d4941ca25ac5c9b6833569485d52f15b76500a67e5fbac4d9865b
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript, which is often used to initiate malicious actions. It also features a link farm pointing to multiple compromised WordPress sites, suggesting an attempt to distribute further payloads or phish users. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9932

Heuristics 8

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stopasbestos.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609ce43e8b8e7---90348645069.pdf
    • https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/q7vq1v1qhd7bbfli93aghidogr/govil.pdf
    • https://bostoncake888.com/UserFiles/files/tiwor.pdf
    • http://www.ebsjosepirosamaria.com/wp-content/plugins/formcraft/file-upload/server/content/files/160941308a7ac5---jutikakon.pdf
    • http://m2m2design.com/userfiles/befexewubabupusikez.pdf
    • http://asu.com.vn/wp-content/plugins/super-forms/uploads/php/files/r60kl6tqoeqo5ntgukm38ob21s/86071888895.pdf
    • https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/39192224ef4cfa12716bae2438a0a4ab/22533459758.pdf
    • http://www.combatsim.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160c2ed900170a---30209690372.pdf
    • http://ljhalls.com/wp-content/plugins/super-forms/uploads/php/files/8b1e313c18c4f058787474eeebcfee08/nopatodozaverotoj.pdf
    • https://freedomtampons.com/wp-content/plugins/super-forms/uploads/php/files/fb4bf37d639a27c94b91b13bd8800b53/94242193731.pdf
    • http://ebbers-schilderwerken.nl/uploads/files/49655585942.pdf
    • http://sakuragiramenandsushi.com/uploads/files/tuxeponomanuwijirafuf.pdf
    • http://ags-sib.ru/ckfinder/userfiles/files/36244359631.pdf
    • http://uat.ideadunes.com/projects/ideadunes-portfolio-site/wp-content/plugins/formcraft/file-upload/server/content/files/160b4b14fdcf30---95158792128.pdf
    • https://mygamedaysports.com/wp-content/plugins/super-forms/uploads/php/files/0fe57b181eefd9d860fd90de974d0ffb/18268186627.pdf
    • http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ca4d1189aa0---rusenuvosexazuvitiver.pdf
    • https://maloneslandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aa3d2b81420---16096351664.pdf
    • http://ziepniekkalns.lv/wp-content/plugins/formcraft/file-upload/server/content/files/1608b6778b1778---46885134534.pdf
    • https://klubkanine.com/home/klub/public_html/ckfinder/userfiles/files/sisop.pdf
    • http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c356f34f050---simugi.pdf
    • http://akgikorea.com/file_upload/fck_upfile/file/34701922299.pdf
    • https://octvads.site/js/ckfinder/userfiles/files/welevozivafavoxizuwijeno.pdf
    • https://avonsteel.com/UserFiles/file/77129181233.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=fifty+shades+freed+full+movie+free+download+for+android
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000f025.bin
30a2c1accd0f9c9a3854a1a16779d42de3b88bef3fd8cbaca328bfd4d31993a8		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF025 23156 bytes
font_00_sfnt_off0000d814.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD814 16792 bytes
font_02_sfnt_off00011862.bin
dd5fd8bc9bcba8672e5be6338935427f2e59db2035b22d50c0d2c77eeb462ebd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11862 17400 bytes
font_03_sfnt_off0001461a.bin
1bd364f6fcdea0994563db65970f56ce853ce021de8948f13162df92472a6040		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1461A 10964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.