Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e38fe21764a1a79…

MALICIOUS

PDF

93.9 KB Created: 2021-08-21 12:49:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: e68cf20231bcffeeeaba7aa5dc1279b6 SHA-1: 44781bd8ac8836b718de67253ee586b4b6ce3ccb SHA-256: 9e38fe21764a1a796afcf856f24ab868be51d44e88a3ee90ac6f1c42d1727c90
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Heuristics reveal it functions as a link farm, with numerous external URIs pointing to compromised CMS uploads and disposable hosting. These links likely lead to phishing pages or further malware downloads, suggesting a multi-stage attack. No scripts were extracted, but the PDF structure itself is weaponized to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wastran.ru/uplcv?utm_term=triggers+joe+sugarman+pdf PDF link annotation
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e5ad614e0f---96222441016.pdfIn PDF document text
    • https://photographerin.agency/wp-content/plugins/super-forms/uploads/php/files/gmn5lpbhd4ki5u4d5lh28ovug2/88901006686.pdfIn PDF document text
    • https://jakspravnenapsa.cz/userfiles/file/fixasotawug.pdfIn PDF document text
    • http://sungwoneng.com/upfile_editor/2021/files/70759672431.pdfIn PDF document text
    • http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/16075880d9a39e---32130631992.pdfIn PDF document text
    • http://scamps.biz/userfiles/file/lofilowivivevebapel.pdfIn PDF document text
    • http://gibisch.biz/files/files/68769148060.pdfIn PDF document text
    • https://okazionche.com/files/58086059827.pdfIn PDF document text
    • http://findplusltd.com/file/poxubejesuvigozisubatikux.pdfIn PDF document text
    • http://lilit-realty.com/wp-content/plugins/super-forms/uploads/php/files/hkovg0gkvpejs7i8vifpe9l2b0/fifutijiliwodekowipuj.pdfIn PDF document text
    • https://insights3.com/wp-content/plugins/super-forms/uploads/php/files/ab88dc27f2796d8d37c59b67ee8f7a2a/67622386867.pdfIn PDF document text
    • http://altinay-law.com/images/file/guxipedatanewifap.pdfIn PDF document text
    • http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/srvpuniq8i6addm71gi63h6aeg/656125220.pdfIn PDF document text
    • https://drsubhashawale.com/ckfinder/userfiles/files/37956820154.pdfIn PDF document text
    • https://aquaticlandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac6f5cc6d6f---wexosura.pdfIn PDF document text
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c503b180572---xazuzudutuwebifurejajadap.pdfIn PDF document text
    • https://tucsonhomewindowtint.com/wp-content/plugins/super-forms/uploads/php/files/1cf8c608c92a7ed2fc76152fcfaaeb47/mewimuwezotusovor.pdfIn PDF document text
    • https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/f7cd018158dff96ccdaec3a3d52de1cf/nunulo.pdfIn PDF document text
    • https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/2coh8mfiaqcfgdfttui2m0f0b8/11505503754.pdfIn PDF document text
    • http://csc025.com/userfiles/file/20210720014313_31guik.pdfIn PDF document text
    • http://szyldkj.com/luodan/images/userfiles/file/norefumukegesa.pdfIn PDF document text
    • http://aksaaydinlatma.com/img/editor/image/file/31246155214.pdfIn PDF document text
    • http://aweibel.com/Photo/file/sexeb.pdfIn PDF document text
    • http://thallo-food.hu/uploads/ckfinder/userfiles/files/rabobuti.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f592.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF592 16616 bytes
SHA-256: 5d7621770fef37caa46d3ea9482ba4d5ee6e241a5d15028bfdef48764f28994b
font_01_sfnt_off0001209d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1209D 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000138ae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x138AE 16092 bytes
SHA-256: 9d5144547e0b729630886a3ad3ce48e7da84b0115899dd9c2390406af6f0fecd
font_03_sfnt_off00014df4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14DF4 10888 bytes
SHA-256: 259841a336c89796a236593cce59be21acebbacfae199e02fabb887dd7e8edb7

Open this report in the interactive analyzer, or submit your own file for analysis.