Malicious PDF — malware analysis report

Static analysis result for SHA-256 a45d6fee42d39449…

MALICIOUS

PDF

88.8 KB Created: 2021-07-12 22:41:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 32d003d2939e76b520fd8e0fc5178df0 SHA-1: 85c41956ddbdaea0e82e1fedc77d8e1f92c8a18a SHA-256: a45d6fee42d3944967795099f7e7e22b1f898306171bfb90ab1b36ee51a30aec
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and numerous external links, many pointing to compromised WordPress sites or disposable hosting, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to redirect the user to a malicious site via the embedded JavaScript or link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9822

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/uplcv?utm_term=unblocked+just+build
    • http://educationexplosion.com/clients/a/aa/aae59ec6301d25964842a0067e0ae100/File/58298741766.pdf
    • http://doorsatyrau.com/ckfinder/userfiles/files/64153195896.pdf
    • http://www.unidacardoso.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160ad99a577142---burilegope.pdf
    • https://www.prestigeautobody.com.au/wp-content/plugins/super-forms/uploads/php/files/58246a3562b19e98d06426143c425dcb/93243703407.pdf
    • http://brothersaluminium.com.np/wp-content/plugins/formcraft/file-upload/server/content/files/16094841957a7c---58976851099.pdf
    • https://cor.org.ar/wp-content/plugins/super-forms/uploads/php/files/f3plgaio3ej98rvvuq74l2r5up/54425635514.pdf
    • http://albatrossmrn.com/konadnew/userfiles/file/latetadapazuzetuwon.pdf
    • http://come2menorca.com/images/file/fekuwobokakabotovezu.pdf
    • http://ahcxdq.com/uploads/file/281253537218.pdf
    • https://www.picmephotoboothhire.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160a95cc9f0951---mawawululujiloxavutuw.pdf
    • http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/u5mm4399mltcjr44bhan777vqo/neparupiwimukariwas.pdf
    • https://sportli.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16081bf97e0f53---66738677457.pdf
    • http://xn--80aafkqcanfpgnhbng3b5i9a.xn--p1ai/pict/file/tenijujumuwenorewukin.pdf
    • http://abwcoliseum.com/uploads/files/9164482181.pdf
    • https://villatoscana-pi.it/userfiles/file/74491304747.pdf
    • http://softwarefactory.nl/images/file/bepemupili.pdf
    • http://springswellness.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b24abc5c540---15477748031.pdf
    • http://urgentcarepb.net/userfiles/file/sewidebirijalo.pdf
    • http://dinskayarealty.ru/media/file/65038471408.pdf
    • http://cimkezes.hu/uploads/ckfinder/userfiles/files/fasonig.pdf
    • http://viquadro.com/userfiles/files/59828266977.pdf
    • http://allycatering.com/userfiles/2136376841.pdf
    • https://soudurelauziere.com/upload/editor/file/13430334782.pdf
    • https://www.fifatravels.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090c66004e3c---581474432.pdf
    • http://arserwood.com/js/fckeditor/editor/filemanager/connectors/php/connector.php/upfiles/file/210601013538802414u2g45d.pdf
    • https://fatheragneliti.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609683bdc58ce---gibizuvufa.pdf
    • https://www.dishdivvy.com/wp-content/plugins/super-forms/uploads/php/files/9cfd74d02040e34b6120b32c5ee9e05f/22156555898.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8dc.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8DC 16792 bytes
font_01_sfnt_off000110f3.bin
96caeb5f0d19d815d28623f74c138c9fcb30a9a6efacabace6ae6ec830df84ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110F3 10572 bytes
font_02_sfnt_off00012924.bin
1fb16e9b236a5aff0b5b1f40447d36e46a497f2aa1b968ba0b1259f5beb0c243		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12924 17152 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.