Malicious PDF — malware analysis report

Static analysis result for SHA-256 a986115102885fd7…

MALICIOUS

PDF

69.4 KB Created: 2021-09-03 13:53:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-29
MD5: 6147705dd45834a5fa30c5e7d13766ec SHA-1: cd76ddec16b0fe24e7354b492fd1fd48e2378c64 SHA-256: a986115102885fd73c1cafae941e6e40353eeefa19bb6b09c0f63eeb1359d451
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm, many hosted on compromised CMS upload directories and uses an image-based lure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9849

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 69 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drmiamiconnect.com/wp-content/plugins/super-forms/uploads/php/files/5f58d6970371c5e5e0c88f1c36384d2a/lebesuforigotozigubeda.pdf In PDF document text
    • http://csc0731.com/userfiles/file/20210809115124_n8bt38.pdfIn PDF document text
    • https://www.analfissur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608374e582f06---1605058905.pdfIn PDF document text
    • https://stellabakingcompany.com/wp-content/plugins/formcraft/file-upload/server/content/files/161292c05b4f38---73443166690.pdfIn PDF document text
    • https://eyetracking.pl/userfiles/file/16244867275.pdfIn PDF document text
    • https://alate.org/admin/fckeditor/editorfile/57846421163.pdfIn PDF document text
    • http://dragonera.cn/admin/userfiles/file/zewogivalufubobunewer.pdfIn PDF document text
    • https://malimbe.africa/wp-content/plugins/super-forms/uploads/php/files/7eab78fca1a83ed5b00da078db323300/74494525529.pdfIn PDF document text
    • https://fmpride.com/wp-content/plugins/super-forms/uploads/php/files/fc66513e6767020b6a5dae4e5e7b9f9b/32504467128.pdfIn PDF document text
    • http://www.startservis.sk/novy/ckfinder/userfiles/files/29216188274.pdfIn PDF document text
    • http://krevue.cz/UserFiles/File/17961012664.pdfIn PDF document text
    • http://www.parkwaytransplant.com/media_upload/upload/files/12282624560.pdfIn PDF document text
    • https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/430sr4h4s2fb0mjm6b9g8n2elc/78006755048.pdfIn PDF document text
    • http://jerseybankruptcylaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/49402008372.pdfIn PDF document text
    • https://asiatravel.kg/wp-content/plugins/super-forms/uploads/php/files/fed4ca146aeee9b44b7f6d02a56e0ba3/87323700092.pdfIn PDF document text
    • https://tuabogadoangel.com/wp-content/plugins/super-forms/uploads/php/files/ba170001df147369fed143f92d92f1c5/24330290764.pdfIn PDF document text
    • https://home18.ru/wp-content/plugins/super-forms/uploads/php/files/54d10aca84f763d4bb7b7929d6b1252b/vogevidowevefifodi.pdfIn PDF document text
    • http://sva-jeanroze.com/xmedia/file/4467371399.pdfIn PDF document text
    • https://mcq-exambd.com/app/webroot/ckfinder/userfiles/files/noxapagukevukotosutabofof.pdfIn PDF document text
    • https://olmitek.by/wp-content/plugins/super-forms/uploads/php/files/c6pnughi0o0ukkemafn2p786t6/5553519921.pdfIn PDF document text
    • https://www.rath-catering.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a5eec8d8298---46667180273.pdfIn PDF document text
    • http://markone-tools.com/upload/files/ledigekupurapig.pdfIn PDF document text
    • http://kepco-group.com/uploaded_files/userfiles/files/19635865355.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c5c4fe3ea7d---lazajem.pdfIn PDF document text
    • https://hotelmitrutarija.com/uploaded/files/97083539446.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/1xuhb7AK25c/uplcv?utm_term=introduction+to+information+technology+pdfPDF link annotation
    • http://mustang.tom.ru/jsplugins/ckfinder/userfiles/files/19823606884.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b4be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB4BE 13748 bytes
SHA-256: eadcb769babf5c1f1fbdc789824ba049a3fee845c65d7d3d854b854dc6f08d9a
font_01_sfnt_off0000d66c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD66C 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000ee83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE83 11064 bytes
SHA-256: f47ad205a07ab8d5665cb72c8ca86f14e7f05a1938b52cc7501c8315a0e57003

Open this report in the interactive analyzer, or submit your own file for analysis.