Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d797ade94452d5e…

MALICIOUS

PDF

75.1 KB Created: 2021-06-28 02:53:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: ce78b62af769e4b4a0c54bca761872cf SHA-1: d0700e4dba13a98274ba99ad66f821b707250a38 SHA-256: 9d797ade94452d5e3cd31736a415b74f56b454ff520251b7264c8b3c6049ddc0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document contains numerous links pointing to compromised WordPress sites and disposable hosting, suggesting it functions as a link farm to distribute malicious content or conduct phishing. The presence of external URIs and link farms strongly indicates an attempt to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=up+and+down+dog PDF link annotation
    • https://monarchwinemerchants.com/wp-content/plugins/super-forms/uploads/php/files/fe5cd223ceee3c70465d1680f406d805/kalokofa.pdfIn PDF document text
    • https://vakukh.ru/wp-content/plugins/super-forms/uploads/php/files/63b309959a51da991bc02e54e4133166/xutozoxuzib.pdfIn PDF document text
    • https://otelnamore.com/wp-content/plugins/super-forms/uploads/php/files/6ef350e6eb99880f7c06f7e686536d8c/bukefunulewipenupolosiz.pdfIn PDF document text
    • http://digimaap.com/wp-content/plugins/super-forms/uploads/php/files/p10kl4o8kv8epoft8pp1783r2i/79866363079.pdfIn PDF document text
    • http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075ec9de2bb2---13600620869.pdfIn PDF document text
    • http://wildpflanzen-planung.de/file/96619137871.pdfIn PDF document text
    • http://pcmcpropertyblog.com/wp-content/plugins/super-forms/uploads/php/files/106c3b4575a7a4f3621ca62b25d2045e/43524757340.pdfIn PDF document text
    • https://driftwoodcc.com/userfiles/files/widubigogepepalop.pdfIn PDF document text
    • https://daiichigroup.net/uploads/news_file/vivaw.pdfIn PDF document text
    • https://ckmandarin.com/uploads/bepow.pdfIn PDF document text
    • https://cutletsmeat.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a44c624b21f---zidapobawazifoparorigujuw.pdfIn PDF document text
    • http://kanstm.com/ckupload/files/nuzanobaz.pdfIn PDF document text
    • http://villa-carlshorst.de/sites/default/files/file/62383727371.pdfIn PDF document text
    • https://bistro-8.com/wp-content/plugins/super-forms/uploads/php/files/f23e449914afa42fc8b9fc1f1f0e1f64/45211336571.pdfIn PDF document text
    • http://www.infranetltd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160841820970da---lijaxijugipuvobunuseresix.pdfIn PDF document text
    • https://sygimportaciones.com/wp-content/plugins/super-forms/uploads/php/files/tphpmhnmh3fdpt0r7bnupid1oj/75407324570.pdfIn PDF document text
    • http://bayzones.com/fckeditor/editor/filemanager/connectors/php/userfiles/file/duxiraruj.pdfIn PDF document text
    • http://www.icodar.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4ba0a0dc8a---4401449048.pdfIn PDF document text
    • http://kids-ex.com/11585732220.pdfIn PDF document text
    • https://kuzeyilac.com/resimler/files/numoveforatefajusu.pdfIn PDF document text
    • https://gelblighting.com/userfiles/files/97292380060.pdfIn PDF document text
    • http://www.infranetltd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b55ed7b2c94---69940193472.pdfIn PDF document text
    • https://jollytime.ru/wp-content/plugins/super-forms/uploads/php/files/62784f755ec0f84b2188ffb07058f551/24379857103.pdfIn PDF document text
    • https://eldorado777.ro/upload/editor/file/90697425653.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c6d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC6D7 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000dee9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDEE9 15976 bytes
SHA-256: 1797c6bec91fc0c8e4c94c19b8339706d821b32226ef5762273c8eaa4e26f28c
font_02_sfnt_off0001080a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1080A 10024 bytes
SHA-256: 1d52db4dd38126427c0c12c7ca2e670a3d7017b30427074cebf20cfc4778e451

Open this report in the interactive analyzer, or submit your own file for analysis.