Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e4348ba088b54dc…

MALICIOUS

PDF

82.3 KB Created: 2021-09-16 04:44:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: 7cf134eb8c5545ec1f9cfdce84519d32 SHA-1: 233bda761c000ef1f92ca0ac83d2c00ed7ed5c95 SHA-256: 9e4348ba088b54dcfa1895ed87655b223bdcd177ac35ae0a4f443fd5b823a30f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous links to external websites, many of which are hosted on disposable domains or compromised CMS uploads, indicating a link farm designed to distribute malicious content. ClamAV and ML classifiers confirm its malicious nature, specifically flagging it as a phishing trojan. The primary attack pattern involves luring users to these external sites, likely for further exploitation or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kielcenoca.pl/files/file/gedimesowaxazediva.pdf In PDF document text
    • http://pactolous.hu/upload/file/33352026542.pdfIn PDF document text
    • http://olympicthesportshop.in/uploads/xixorijevoneboloki.pdfIn PDF document text
    • http://solar-makernavi.com/ckfinder/userfiles/files/41165306958.pdfIn PDF document text
    • http://eros-arena.de/eros/userfiles/file/178488437.pdfIn PDF document text
    • https://sidexsideaudio.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614117fcae9c6---22773278051.pdfIn PDF document text
    • https://www.retake.dk/ckfinder/userfiles/files/katasonorepomebavodabaluk.pdfIn PDF document text
    • https://www.weldcor.ca/public/ckfinder/userfiles/files/86283533679.pdfIn PDF document text
    • http://newtrichur.com/userfiles/file/65963580257.pdfIn PDF document text
    • http://123flower.doweb.kr/upload/files/76472826989.pdfIn PDF document text
    • https://nirkongrp.com/ckfinder/userfiles/files/50011349594.pdfIn PDF document text
    • https://www.saltriot.com/wp-content/plugins/super-forms/uploads/php/files/efd8b1675331d426be2c98e5522f7e0e/xivisegatuje.pdfIn PDF document text
    • https://vntdc.com/upload/fck/file/13080498747.pdfIn PDF document text
    • http://friulanapanini.com/images/file/61705427507.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132f36e35f68---73117287382.pdfIn PDF document text
    • https://www.cylinder96.ru/admin/ckfinder/userfiles/files/filowutigebozujunobix.pdfIn PDF document text
    • http://ventilyatsia-v-sochi.ru/ckfinder/userfiles/files/nosakopovokupiban.pdfIn PDF document text
    • http://goddesshair.net/upload/users/files/wigikafinolagugetuxapex.pdfIn PDF document text
    • http://www.logistiekverbeteren.nl/ckfinder/userfiles/files/90695667590.pdfIn PDF document text
    • https://nationalcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/16133f8c0b3639---2568195838.pdfIn PDF document text
    • http://runhouchem.com/upload/files/xupelawofibig.pdfIn PDF document text
    • http://cargo3030.ru/wp-content/plugins/formcraft/file-upload/server/content/files/161396d5d2221d---65360232887.pdfIn PDF document text
    • https://123kozijnofferte.nl/wp-content/plugins/super-forms/uploads/php/files/c436b7b60bf419a2c1adc0bab628031e/tapovaz.pdfIn PDF document text
    • http://acrclubinversores.com/files/galeria/files/jajutuxixibo.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=payback+2+apk+mod+downloadPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dda2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDA2 10640 bytes
SHA-256: 908085160c41ee402501e35356c71da3bd27f2dac20946678d39caf84ea0aa7e
font_01_sfnt_off0000f5e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5E6 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00010df8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DF8 17580 bytes
SHA-256: 67f873c4c8794ae78043df21416eadb47293aa6ddc46ca5e51e7ba92dc324548

Open this report in the interactive analyzer, or submit your own file for analysis.