Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac2097ed50003fe7…

MALICIOUS

PDF

93.0 KB Created: 2021-07-06 16:03:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: d15aa0f1da8d5483a67b500f561ecd95 SHA-1: 1a133389f992f4b4393515bf48cfd76a78f5bff0 SHA-256: ac2097ed50003fe7b28001802d213a41287d54cf34fd74a6c3814fd79f69bc40
276 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1539 Steal or Forge Credentials T1056.004 Web Browser

The PDF document exhibits multiple high-risk heuristics indicating a phishing or credential harvesting attempt. It presents a fake CAPTCHA or human verification prompt, and a lure for password-protected archives or MFA codes. The document also contains numerous links to external PDFs hosted on potentially compromised or disposable domains, suggesting a link farm designed to redirect users to malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9924

Heuristics 9

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://people11people.com/uploads/File/zoxumojezunege.pdf In PDF document text
    • https://aadhaarretail.com/administrator/imagetemp/file/91685362938.pdfIn PDF document text
    • http://www.timtransportes.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/1607c29d354194---nulixuletomizadazovizuxu.pdfIn PDF document text
    • http://okmarin.ru/userfiles/file/bedufotinitamiginoz.pdfIn PDF document text
    • https://lion-trading.co.uk/wp-content/plugins/super-forms/uploads/php/files/5uch3k8cb4bccbs5oe2stekjnq/64244821975.pdfIn PDF document text
    • http://www.dadosefatos.net.br/wp-content/plugins/formcraft/file-upload/server/content/files/160dae4cfa6839---baxekajuvanunulu.pdfIn PDF document text
    • https://ludifrance.fr/userfiles/file/16772279690.pdfIn PDF document text
    • https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/41912c9fbd89705d84145f2b2a1431a7/77207334052.pdfIn PDF document text
    • http://www.blackhillsdancecentre.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c28fd924ca3---mabives.pdfIn PDF document text
    • http://wtmongolia.com/materials/file/vuwudanujetijiwonowukaza.pdfIn PDF document text
    • http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/e016eccbf9b75bd7e4b136c18ae7995e/23717792978.pdfIn PDF document text
    • http://uniquecharacters.com/upload/files/watejivapirutol.pdfIn PDF document text
    • https://yarsan.ru/wp-content/plugins/super-forms/uploads/php/files/7c142488ad0caba66abb6137a4ec8c5a/99793180502.pdfIn PDF document text
    • http://langfordfinancialservices.com/userfiles/files/73380449166.pdfIn PDF document text
    • http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/7186dgjoak1qh15vg1nmmlomc7/mizumuwopewefo.pdfIn PDF document text
    • https://kund-in.com/userfiles/file/lajini.pdfIn PDF document text
    • http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086cacb50e8e---bozixiwojor.pdfIn PDF document text
    • http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160813465726ea---tujazepobotumuzeze.pdfIn PDF document text
    • http://mbcasc.net/imgs/file/30399651812.pdfIn PDF document text
    • http://www.amedna.com/userfiles/files/49154296876.pdfIn PDF document text
    • http://fixafilm.se/userfiles/file/20786995303.pdfIn PDF document text
    • http://www.maoles.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d9f3ceb09d---64840873439.pdfIn PDF document text
    • https://plumcourse.com/wp-content/plugins/super-forms/uploads/php/files/18577dabf16679321746133e4bac8bf4/filonusezowazusowoguj.pdfIn PDF document text
    • https://bykevin.com/wp-content/plugins/super-forms/uploads/php/files/078dafec294a7dfaa9d257074c6a7db3/39631218293.pdfIn PDF document text
    • http://lifestyleufa.ru/wp-content/plugins/super-forms/uploads/php/files/3860abdc94ef7926b1ad18baed22cfd3/zajisikewebezifemediganu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=how+to+get+free+accounts+on+fortnitePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f06a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF06A 18044 bytes
SHA-256: d0e3eefe5634c6809da0a6e71e01c20d7e28fce72dbe38619ca4fb740a7c5898
font_01_sfnt_off00011fee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11FEE 16164 bytes
SHA-256: fd494554c7a7a2c4488382a78096c535ff133766c7221992be4f6a58596b2467
font_02_sfnt_off00013564.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13564 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00014d7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14D7B 10644 bytes
SHA-256: 51805e40fd1e93b8ad027be3c446dd571b4ef907d8e79680a1a976e5cfa34c75

Open this report in the interactive analyzer, or submit your own file for analysis.