Malicious PDF — malware analysis report

Static analysis result for SHA-256 abd3d5bc0aefa1df…

MALICIOUS

PDF

89.0 KB Created: 2021-09-01 23:04:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 6e0fbbbc9dda9346cb69d13774cb25e3 SHA-1: 61a02029b380ae7842370c95ae74b00e942251fc SHA-256: abd3d5bc0aefa1df80eeff6357afb6d683afaadcb93aeb9a1d0152ef78150786
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, including a ML classifier and ClamAV detection. It contains numerous embedded URLs pointing to compromised websites and disposable hosting, suggesting a phishing or malware distribution campaign. The presence of PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics indicates a deliberate effort to create a link farm for SEO manipulation or to host malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9973

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=cat+with+green+and+blue+eyes PDF link annotation
    • https://cullinanconstruction.com/wp-content/plugins/super-forms/uploads/php/files/febavam133hfbs0f70lg724a2s/vipedufugobij.pdfIn PDF document text
    • http://kopdesign.nl/userfiles/file/58903324099.pdfIn PDF document text
    • http://okmarin.ru/userfiles/file/modagobiboxulozepikajoze.pdfIn PDF document text
    • https://ehblending.com/wp-content/plugins/super-forms/uploads/php/files/b22591f275f76ae571d1eda8d27da8d7/boketenoxoxapuvafo.pdfIn PDF document text
    • http://wypelnienia.kratex.pl/wp-content/plugins/super-forms/uploads/php/files/a1e2df1b61eb497b947ab530674b7987/lovebisu.pdfIn PDF document text
    • http://bluefield1966.com/clients/26642/File/bufelalaxukejegesir.pdfIn PDF document text
    • http://comicpapyrus.com/wp-content/plugins/super-forms/uploads/php/files/6bc458a4492cbebfec1de445c1667fbd/zawujunafajorumagi.pdfIn PDF document text
    • http://builderall.info/userfiles/file/3600698800.pdfIn PDF document text
    • http://mousike.it/img_ins/files/zojojadasijiro.pdfIn PDF document text
    • http://polyacer-ecp.com/userfiles/files/20210823_064233.pdfIn PDF document text
    • http://chelseacarpet.com/ckfinder/userfiles/uploads/jiliwejupegebaru.pdfIn PDF document text
    • https://asiaviews.org/wp-content/plugins/super-forms/uploads/php/files/o20998ohnj9gsirvp0kv1al6l3/45717734560.pdfIn PDF document text
    • http://colorfulmedia.de/fotki/fotki/file/32970618407.pdfIn PDF document text
    • http://pavcargo.ru/wp-content/plugins/super-forms/uploads/php/files/3661a58746d3bc1901502f7e714938ff/zusisawudenakijeraruviven.pdfIn PDF document text
    • http://tsg-edinstvo.ru/userfiles/file/14970836491.pdfIn PDF document text
    • https://murtenhof.ch/userfiles/files/28188447202.pdfIn PDF document text
    • http://hakkabrothers.com/userfiles/file///xeluwirotavifised.pdfIn PDF document text
    • https://actor-conseil.com/files/file/kejovudugukidefosutesu.pdfIn PDF document text
    • http://anhuishangbiao.com/upload_fck/file/2021-6-5/20210605035441163897.pdfIn PDF document text
    • https://aptitudeclass.com/ckfinder/userfiles/files/46102904370.pdfIn PDF document text
    • https://lawpropertyconsultants.co.uk/wp-content/plugins/super-forms/uploads/php/files/ql7422trbaebk56fjauekse366/zasuv.pdfIn PDF document text
    • http://svsteinfurth.de/radsportfiles/file/92088345345.pdfIn PDF document text
    • https://laser-arena.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1606ccbfd6e85f---xitibaloli.pdfIn PDF document text
    • https://alignerco.com/wp-content/plugins/super-forms/uploads/php/files/50d418741532f331f7b87b73bb97cec8/43559731052.pdfIn PDF document text
    • https://tirthmobile.com/wp-content/plugins/super-forms/uploads/php/files/qp51numlu5dhij3q3tsgtg34v5/67427801796.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3A1 10880 bytes
SHA-256: 3e28b460eea2307f5a441a2965cfb46437cbb8877426dbc8edab120f5a6c9798
font_01_sfnt_off00010c97.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C97 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000124a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124A9 18256 bytes
SHA-256: 9129169a3a669169505cb82065e87a98dca665941e9521752fd43001ce7f45b2

Open this report in the interactive analyzer, or submit your own file for analysis.