Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6376b9dd40b064f…

MALICIOUS

PDF

109.5 KB Created: 2021-07-19 00:01:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 06bc2ac96459886870cb816474349717 SHA-1: 916f460f452eb5b6a215cbefb31955b4cfc9b043 SHA-256: a6376b9dd40b064f208b8d5cf43d1061ad55d17860148aa64ebb68335c77348c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for Pdf.Phishing.Trojan. The presence of numerous links pointing to compromised CMS upload storage and disposable hosting indicates a link farm designed to redirect users to potentially harmful content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9797

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a10ddc77a49---gabejekemeviz.pdf
    • http://vdgairconditioning.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16084bcbb13d26---wuwulilebivejawetexerof.pdf
    • https://hartwellcook.com/wp-content/plugins/super-forms/uploads/php/files/9ef0749466fbadc22770385935b8d22f/64822881269.pdf
    • http://serendipityorlando.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077eb60cef5f---14499084735.pdf
    • https://isosklo.cz./uploads/nikos.pdf
    • https://xn--80adj7cxa.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/b4a11a7e61c53467d1f509617d3909d2/xabazejevowen.pdf
    • https://hotelristorantenovecento.it/wp-content/plugins/super-forms/uploads/php/files/de1b4091ccef56cbc09a65f5ae14043a/71340105245.pdf
    • http://www.naraihillgolf.com/admin/userfiles/file/lomojefotuvam.pdf
    • http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/of4t1jtbbjcvq1db55hics26h2/fizuwelokobizugedoru.pdf
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609dcde8839d9---87458243295.pdf
    • http://solartgaleria.hu/images/file/kugodibemagigujafuga.pdf
    • http://aeronautike.com/userfiles/file/18472684762.pdf
    • http://www.recetasyconsejos.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b7b32a8bc9e---82764654141.pdf
    • http://www.johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1607eae223370d---86016550249.pdf
    • https://trichynext.com/wp-content/plugins/super-forms/uploads/php/files/985ab4187bc44f58f56f6388937bf699/68768689515.pdf
    • http://consade.com/userfiles/file/45820361665.pdf
    • https://kenkochaya.com/user_data/ckfinder/files/84788758098.pdf
    • https://harpethvalleyhealth.com/wp-content/plugins/super-forms/uploads/php/files/d06a6cfe4038c3ad6359d7ada45cefe9/9275594224.pdf
    • https://lllk.ru/wp-content/plugins/super-forms/uploads/php/files/992a7a60ae39bc00afd432ff7e0dd6fe/89772261308.pdf
    • https://dacoma.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160727ee674799---53732443808.pdf
    • https://purebodycare.courses/wp-content/plugins/super-forms/uploads/php/files/q3fbsgvcrjcnp9p54mnrh9he96/28121902560.pdf
    • http://dh-life.com/ckfinder/userfiles/files/7043502242.pdf
    • http://fabrykakonwersji.pl/wp-content/plugins/super-forms/uploads/php/files/b2e202d790c58fbccc3b60cc4a69cfed/33688042579.pdf
    • http://woonhuislift.info/wp-content/plugins/formcraft/file-upload/server/content/files/160ba399f1eb5b---logabumowimaja.pdf
    • https://kisikana.hr/userfiles/file/jixizurigofowuwezoxanaxe.pdf
    • http://tivatijapan.com/uploads/userfiles/file/rapugadukavofebojopumabi.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/A3Ryygt5BCM/uplcv?utm_term=scorpion+moves+mk11+switch
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000147f4.bin
8df3dc5d8db1a7963d9a863e6f1b6765f08a075a107749495d0049e387893cb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x147F4 10804 bytes
font_01_sfnt_off000160b8.bin
a015f86240aedd1249c3966128554743c14da6573af043d9338e4ce4b35e615c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x160B8 18024 bytes
font_02_sfnt_off00019074.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19074 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.