Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7939fbd8b4b274f…

MALICIOUS

PDF

78.9 KB Created: 2021-07-14 09:09:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-07
MD5: 745aaf60f044c2ca7e670264416e6cae SHA-1: 2634d06440221c98b8f92871efb11b6c9a5c556a SHA-256: a7939fbd8b4b274fcc48a704ed62295967c74c22595cd2a6fbc4d3cb49acad76
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as a malicious PDF by ML classifiers and ClamAV. It contains numerous external links, many pointing to compromised WordPress sites or disposable hosting, suggesting a link farm or phishing lure. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates a strategy to distribute content via non-clustered, disposable hosting, and the PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristic suggests compromised infrastructure is being leveraged. No scripts were extracted, but the overall structure and heuristics point to a malicious intent to redirect users to potentially harmful external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9958

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/uplcv?utm_term=willow+2+chippy PDF link annotation
    • http://www.insight-assessment.com/ckfinder/userfiles/files/2081081479.pdfIn PDF document text
    • http://sns-russia.ru/userfiles/file/88585837731.pdfIn PDF document text
    • http://logisticsnetworks.net/ckfinder/userfiles/files/paresawufediwegamikebopam.pdfIn PDF document text
    • https://economiadecomunion.net/ckfinder/userfiles/files/gomijotumojewobe.pdfIn PDF document text
    • http://www.hollyskauaicondo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e48b6f4616b---mevonikunupafapezesep.pdfIn PDF document text
    • https://k-kompany.ru/wp-content/plugins/super-forms/uploads/php/files/d520a27e1ade020f16496af27d5756b6/suruwa.pdfIn PDF document text
    • https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/28lmjialg8n46oltaa9ti0li8u/xofowenororasijaxegoluxaj.pdfIn PDF document text
    • http://www.iamgoingto1996.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bd09752e26---wupodupemowotevikaxa.pdfIn PDF document text
    • https://braviengenharia.com.br/wp-content/plugins/super-forms/uploads/php/files/89ktnjfme34alf4f5fs4coe579/62772797250.pdfIn PDF document text
    • http://ziepniekkalns.lv/wp-content/plugins/formcraft/file-upload/server/content/files/1608105eedf4fe---vatosoveganoxuxosaxunokam.pdfIn PDF document text
    • https://polskieplytki.com/wp-content/plugins/super-forms/uploads/php/files/fc5c76e827122585001f66f0779494dc/navipazama.pdfIn PDF document text
    • http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca93d92b2b---rixoxu.pdfIn PDF document text
    • https://www.parkgest.ch/wp-content/plugins/formcraft/file-upload/server/content/files/160800b71764fe---wimigazafitesi.pdfIn PDF document text
    • https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/35shvqlefins2ms1r1k6gcjmln/tusafujafiv.pdfIn PDF document text
    • https://roofmed.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160aa186614a2e---78679520464.pdfIn PDF document text
    • https://www.caesarstravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16093a23e54e0a---40037666286.pdfIn PDF document text
    • http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/160768927b922c---86514190059.pdfIn PDF document text
    • https://www.bocamvigliesrooms.com/wp-content/plugins/super-forms/uploads/php/files/e22a8a194f2bcf5aa152252d86d2e9f1/jevikafusimudaroxuwi.pdfIn PDF document text
    • https://kurek-rowery.pl/user_pict/file/bazovujugavi.pdfIn PDF document text
    • https://www.darrellstuckey.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085d4fa16249---89936177932.pdfIn PDF document text
    • https://amkboiler.com/wp-content/plugins/super-forms/uploads/php/files/6hu9n0fja2j7ifm9tofh288v57/50490728854.pdfIn PDF document text
    • http://businessplan-capalpha.fr/mbp/upload/images/images/upload/ckfinder/39408183424.pdfIn PDF document text
    • https://www.qlsny.com/wp-content/plugins/super-forms/uploads/php/files/ee10c06fa34b21d46fc008124235f8bf/gowegadofojovutofem.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d5a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD5A6 10020 bytes
SHA-256: 366ab0f67ebbd5de043c0cec67fa6d0075b8ff4f49a6fe376b9fd44bca83db1c
font_01_sfnt_off0000ec1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC1B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0001042d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1042D 16420 bytes
SHA-256: 699e3bc48ad30af1a0e40dc1883478fec4b69e91505dcbed288c1173d94685be

Open this report in the interactive analyzer, or submit your own file for analysis.