Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa430c23fa63fa5f…

MALICIOUS

PDF

94.2 KB Created: 2021-06-27 22:11:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: d65c15adcfa4b9ba97d9ae0936b34a0e SHA-1: a360bbcaa0930959c0bda9473ccf7d6658b94408 SHA-256: aa430c23fa63fa5fb36f6dc5c6f28d586b711a11ac241ff26748fed869467441
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample was detected by ClamAV as a phishing trojan and flagged by an ML classifier. It contains numerous links to compromised WordPress upload directories and disposable hosting sites, indicating a link farm designed to redirect users. The PDF structure itself is also noted as potentially compromised, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9935

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ises.ca/phpsites/vertical_living/uploads/file/nonemoxat.pdf In PDF document text
    • https://aodaixuan.vn/app/webroot/upload/image/files/padafuborezakewozag.pdfIn PDF document text
    • https://nobleanimalsanctuary.org/wp-content/plugins/super-forms/uploads/php/files/tmp/xelenirujobenuger.pdfIn PDF document text
    • https://drsubhashawale.com/ckfinder/userfiles/files/takop.pdfIn PDF document text
    • http://agcslohian.com/userfiles/file/rilebareboj.pdfIn PDF document text
    • https://1sis.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f6eefce298---zezowodafolopisorufoke.pdfIn PDF document text
    • https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/595768ef31d64cb9eb74fa70e857e677/tozomutozixa.pdfIn PDF document text
    • http://savitapiti.org/ckfinder/userfiles/files/vofepurexivarim.pdfIn PDF document text
    • https://drahmetbostanci.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c6949cd480e---xezoda.pdfIn PDF document text
    • https://www.pennlighting.com/wp-content/plugins/super-forms/uploads/php/files/a5c1f4682914d9e4d95ab2815dad11ef/biwawejezugujulobuwidokad.pdfIn PDF document text
    • http://workprohealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608aae1417171---52415189350.pdfIn PDF document text
    • http://mouaumfb.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d7cf6005c64---nixozirazarizeguzejeda.pdfIn PDF document text
    • https://ringid.vn/ckfinder/userfiles/files/dixepakamizojolizoje.pdfIn PDF document text
    • https://nacionalequipamentos.com/ckeditor/uploads/files/kidunirepafavivadofur.pdfIn PDF document text
    • https://happycustomerservice.com/wp-content/plugins/super-forms/uploads/php/files/530581a515459fe51e62b77c5a831456/vudobigoli.pdfIn PDF document text
    • https://medtek.vn/storage/file/22651850138.pdfIn PDF document text
    • http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d4c62463ec---73783100379.pdfIn PDF document text
    • https://banktapeunadana.com/tapeunadana/bank2/admin/userfiles/file/64057695569.pdfIn PDF document text
    • http://herodumpsterrental.com/wp-content/plugins/super-forms/uploads/php/files/354062247b884c24893a93042f9c248f/gemivonuvusobasujifokajof.pdfIn PDF document text
    • https://baongochoa.com/upload/file/xatuzutilenipo.pdfIn PDF document text
    • http://prodesign31.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16072576d23a86---lafize.pdfIn PDF document text
    • https://www.travelticket.com.au/wp-content/plugins/super-forms/uploads/php/files/jnoqa6q5g2l8i2fh5fkvul6fvm/33270846232.pdfIn PDF document text
    • http://megalabsrl.it/userfiles/files/xijafazonupavojizob.pdfIn PDF document text
    • https://www.alapan.org/fckimages/file/3612688035.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/cv9VXjIrmdE/uplcv?utm_term=switchgear+and+protection+interview+questions+and+answers+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a2b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A2B 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0001223d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1223D 17636 bytes
SHA-256: aa821a3da4a716954fca90f4dcc473d1404a030ac9ab9a5c2a2e3943b4418e6e
font_02_sfnt_off000150b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x150B3 11324 bytes
SHA-256: 00347d3e787b577597cb380d7921c632ade4fc71c48788ca58a6c03277443fef

Open this report in the interactive analyzer, or submit your own file for analysis.