Malicious PDF — malware analysis report

Static analysis result for SHA-256 abb420313c5bfa74…

MALICIOUS

PDF

82.9 KB Created: 2021-09-01 21:00:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: fd6f47bce0f4bb6abc9ea89d0d80f8d3 SHA-1: 0b4d9dc06b74d68da64ee9d04b5addbda6d2f376 SHA-256: abb420313c5bfa74a5069aaf73e9b0c29db44c1636f965a63d43ce349c5fd54a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The heuristics reveal it functions as a link farm, directing users to multiple compromised websites hosting further PDF files. The presence of external URIs and the structure of the PDF suggest an attempt to distribute malicious content or phish for information through these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://naseeha.org/wp-content/plugins/super-forms/uploads/php/files/a819f3b08cc5f7805cf41be7fb67bdf7/59197681261.pdf In PDF document text
    • http://princeton1959.com/clients/863834/File/44541465056.pdfIn PDF document text
    • https://doellefjelde-mussemarked.dk/images/newsmail/file/64793202825.pdfIn PDF document text
    • https://shared401k.com/wp-content/plugins/super-forms/uploads/php/files/2699e5aad49113d355f5ca22e62e9317/58713949981.pdfIn PDF document text
    • http://brodart01.com/wp-content/plugins/super-forms/uploads/php/files/k6rp59u5atsh12l14g9oo9qqq2/8330546564.pdfIn PDF document text
    • http://www.nationaalgolfcongres.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a18d02a1a2b---gefebolu.pdfIn PDF document text
    • https://total-sport.pl/img/upload/files/dimoseviruverobilided.pdfIn PDF document text
    • https://www.grandiosa.is/wp-content/plugins/super-forms/uploads/php/files/coi71dr26kaclgkpm0qt0qmdr5/vuduridebebunenarirex.pdfIn PDF document text
    • http://anhuizhkj.com/upload_fck/file/2021-5-6/20210506205232844675.pdfIn PDF document text
    • http://basaritarim.net/admin/editor_resim/file/27536889250.pdfIn PDF document text
    • http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608c46d0942c6---natagux.pdfIn PDF document text
    • https://360clothing.indicsys.com/home/www360cl/public_html/uploads/images/files/dogilirokavibifatozuf.pdfIn PDF document text
    • https://ambalatender.com/upload/files/51867153897.pdfIn PDF document text
    • http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160c9c4f6435f1---gilopisorevapisa.pdfIn PDF document text
    • http://akademibt.com/resimler/files/51301370703.pdfIn PDF document text
    • http://www.caribbeandentist.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c975192a8a---30701492391.pdfIn PDF document text
    • http://sun-green.eu/ckfinder/userfiles/files/67207741395.pdfIn PDF document text
    • http://uniroll.pl/user_images/file/zalupu.pdfIn PDF document text
    • http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609bd10fac9d7---pisodowuv.pdfIn PDF document text
    • https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/c92737c873c782009e2d3b40940c1a78/4042397724.pdfIn PDF document text
    • http://aftckwt.com/uploads/file/88016423279.pdfIn PDF document text
    • http://tourbusan.net/FileData/ckfinder/files/20210803_37A352FDC8CC2C94.pdfIn PDF document text
    • http://dokumsuzgec.com/userfiles/files/lajebubosa.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3vuEKuznOb8/uplcv?utm_term=prayer+points+for+mercy+and+forgivenessPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF26 17488 bytes
SHA-256: fa3aadb83ddab1b8325bcb1c40d0755a29c31997e6ee55c837b63d1f3c29e60b
font_01_sfnt_off00010bea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10BEA 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00012401.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12401 11096 bytes
SHA-256: bfac953ea1f389a5882d10e4681a6162b6af28af6151c42d80cdf558a216ac1d

Open this report in the interactive analyzer, or submit your own file for analysis.