Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3be462520bf4cd6…

MALICIOUS

PDF

82.4 KB Created: 2021-08-26 11:07:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: bfc917c7c502ae2203d7b728dabdefb7 SHA-1: e3358c40536004b5c48bfe4227c3eb7ab8a809dd SHA-256: a3be462520bf4cd6b89805f896e6f02606702bb22f32589ff7bf313f050ecb25
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristics reveal it functions as a link farm, directing users to numerous external URLs, many hosted on compromised or disposable domains, suggesting a phishing or malware distribution scheme. The presence of external URIs and link farm characteristics points towards an attempt to lure users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=tab+command+in+stata PDF link annotation
    • http://thedreams.cz/files/zizifewamurobekimopivub.pdfIn PDF document text
    • http://jiehuist.com/userfiles/files/21845436016.pdfIn PDF document text
    • http://www.radiopopiatej.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b79974633eb---55217805707.pdfIn PDF document text
    • https://amrapalispot.com/userfiles/file/49413583327.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16120f473bb397---tetovozubezijelu.pdfIn PDF document text
    • https://gk-termopanel.ru/wp-content/plugins/super-forms/uploads/php/files/8a4b4e3f836c8080d739d33288ad67a2/nonusijetapofejivilixanu.pdfIn PDF document text
    • https://fleuriste79.fr/ckfinder/userfiles/files/pijesolalasesigavanipazu.pdfIn PDF document text
    • http://0-50.ru/userfiles/file/82622122346.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f9cac849edd---18309503274.pdfIn PDF document text
    • https://prosaison.fr/userfiles/files/70543691272.pdfIn PDF document text
    • https://primeodontorj.com/wp-content/plugins/super-forms/uploads/php/files/798d01cbf21ad2366985e3e40f778794/47674212792.pdfIn PDF document text
    • http://vetranhtuong.info/luutru/files/piniveveguximigimuvanemu.pdfIn PDF document text
    • http://theleadershipworks.com/PO2/UPFILE/userfiles/files/36976824590.pdfIn PDF document text
    • https://archcosmeticstudio.com.au/wp-content/plugins/super-forms/uploads/php/files/a0b6c588fb5d2d928a83e174bf42dae7/gatezaxotenedazupefigexov.pdfIn PDF document text
    • http://trenermichal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16098474e2ddbc---sipoxesitefati.pdfIn PDF document text
    • http://novaserv.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081d3bf18789---molonagurefolixalewexe.pdfIn PDF document text
    • https://www.cr-sdc.org/wp-content/plugins/super-forms/uploads/php/files/a407b3e72f20de4e07a29e0e4b6caacb/63534338796.pdfIn PDF document text
    • http://leebyunghun.org/new/upload/board/files/84997091286.pdfIn PDF document text
    • http://veronicanealhome.com/wp-content/plugins/formcraft/file-upload/server/content/files/2/160f8e28f9056d---tugitimi.pdfIn PDF document text
    • https://jgmurphy.com/wp-content/plugins/super-forms/uploads/php/files/babbc2b4f2817dc7a00ad9e9b132613a/kovowuzumanudejekekilag.pdfIn PDF document text
    • https://eandjfamilyhealthcenter.com/wp-content/plugins/super-forms/uploads/php/files/afbeb4c50de6e17c99c188d1bce3cd3f/11381888677.pdfIn PDF document text
    • http://megat.pl/uploaded/fck_files/file/wuzelemifedupib.pdfIn PDF document text
    • http://cgt-fo-csc.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607e17b4a5845---19005461932.pdfIn PDF document text
    • https://primeodontorj.com/wp-content/plugins/super-forms/uploads/php/files/44a1485914e45517433bece95e6dd9b8/widanowiposaredifudujave.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de01.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE01 17636 bytes
SHA-256: 48e2edd2f0cd3268ce6961b33c34c94e743db422184fd6e90105efc44837ade6
font_01_sfnt_off00010c12.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C12 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00012429.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12429 10356 bytes
SHA-256: 7d061b8a8b0b7fface1320ef0cced5f1e6bab8f0f8198a220ca69fbe378f15aa

Open this report in the interactive analyzer, or submit your own file for analysis.