Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa0cc43b29d6956f…

MALICIOUS

PDF

90.1 KB Created: 2021-07-22 20:35:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 729674a4f897c3b68333c144831cc3f0 SHA-1: 41857642851fb1b365c898ce654729cf149f68b9 SHA-256: aa0cc43b29d6956fa4ad564ec840f4c13753feaea8860e159eb042f1b4aa858f
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. Heuristics indicate the PDF contains a link farm pointing to compromised CMS upload storage and uses a deceptive download button lure. The embedded URLs suggest an attempt to redirect users to malicious content hosted on potentially compromised websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9940

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/c03ea7c19ed99a0937afb67ab6a99b22/kaxawinukotegonuxosi.pdf In PDF document text
    • http://szrealty.net/uploadpic/2021-6/file/2021060503051373499.pdfIn PDF document text
    • https://sancarspune.com/wp-content/plugins/super-forms/uploads/php/files/60b16eb205537cbe005951e1197a3669/25769679885.pdfIn PDF document text
    • https://bibliothequedesarts.ch/ckfinder/userfiles/files/18597910486.pdfIn PDF document text
    • https://afanasyev-design.ru/wp-content/plugins/super-forms/uploads/php/files/782fe6410da50e1b717fd8de8304d5af/68285446305.pdfIn PDF document text
    • http://stewartreunion2020.com/clients/2/2a/2a0d9dcdd57715375c9f4393c24df0f2/File/pugurigunolej.pdfIn PDF document text
    • http://www.infranetltd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160839239d8952---pelanulemi.pdfIn PDF document text
    • http://manufim.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/160db4ead9d611---93897841031.pdfIn PDF document text
    • https://www.tai.gr/wp-content/plugins/formcraft/file-upload/server/content/files/16072f256f0db8---nazimodud.pdfIn PDF document text
    • https://voyagerf.ru/wp-content/plugins/super-forms/uploads/php/files/b4b3cb94eebf3f3e38dc0bf8b2d84538/76625849392.pdfIn PDF document text
    • https://aptitudeclass.com/ckfinder/userfiles/files/97508764034.pdfIn PDF document text
    • http://otvorene-srdce.sk/userfiles/file/51459762601.pdfIn PDF document text
    • http://bmhs1963.com/clients/7/72/7286fd37811b7a5dece6e69924e4d5ab/File/sepokigafuninopidagoma.pdfIn PDF document text
    • http://amuseonline.com/absite/userfiles/file/tikemoxudutakaliluvuxiza.pdfIn PDF document text
    • http://lawcab.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160d5ecae5498f---25265696951.pdfIn PDF document text
    • https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/c95e2b37d8b03837009b75230c8a73cc/86795671394.pdfIn PDF document text
    • http://eduomania.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a24a86a9212---sivunixodogumivobuzojo.pdfIn PDF document text
    • https://imagebuzz.net/ckfinder/userfiles/files/terezetuvetako.pdfIn PDF document text
    • https://g3az.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca982a4a5b---todebamuguxen.pdfIn PDF document text
    • https://law.com.sg/wp-content/plugins/super-forms/uploads/php/files/3a4b74846ac62b77f33046a029d8e8ca/lusorizebezunux.pdfIn PDF document text
    • http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bda83eef14f---92176619590.pdfIn PDF document text
    • https://mosconi.net/userfiles/file/tesalugiwujazowepoxitevor.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=ant+man+and+wasp+downloadPDF link annotation
    • http://lovewhereyoulv.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/41f0c5fd1a287357682abf6c37435547/98070611985.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE0A 16684 bytes
SHA-256: 5786d7639d2cc1522a1a3889fae5b5c9fbcbd5f5c9de2f5a2930a0e54327038d
font_01_sfnt_off0000f5a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5A8 10296 bytes
SHA-256: 5eed8fc4bf9923b521284349b84dd0aec4e0e4ca272ec2bac76676e1cab496a6
font_02_sfnt_off00010ce6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CE6 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off000124f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124F8 21100 bytes
SHA-256: 1052b9e1593f4fdf37435eaeb52a16097393094b363029cdc7c0e3953ca9b6ef

Open this report in the interactive analyzer, or submit your own file for analysis.