Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad2b8c7f45b05e50…

MALICIOUS

PDF

88.3 KB Created: 2021-07-24 13:49:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-14
MD5: 80f2a356bb6839a4435278cddbbc6f15 SHA-1: ab7212d21f3cc61c772f96a775600ee0f4f6e621 SHA-256: ad2b8c7f45b05e50d8fb99b0e883edaaaea32ad21d9d77cf6a17631ac6f0e02d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as a malicious PDF by ClamAV and an ML classifier. It contains numerous links to external websites, many of which are hosted on compromised CMS platforms or disposable domains, suggesting a link farm or phishing lure. The presence of PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics indicates a pattern of using such sites for distribution. No scripts were extracted, but the overall structure points to a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://etre-cheval.fr/Applications/MAMP/htdocs/etre%20cheval/news_pix/file/fogarewasijisatododaj.pdf In PDF document text
    • http://sumnerclassof1976.com/clients/4/49/49b54eafcc86ae0c30eb104ab8b91c7c/File/11170334539.pdfIn PDF document text
    • http://www.empresasdelimpeza.info/wp-content/plugins/formcraft/file-upload/server/content/files/1608ee5e90974f---50905352361.pdfIn PDF document text
    • https://limpjet.com.br/wp-content/plugins/super-forms/uploads/php/files/be2c0370299705d9547f6f044f0fbe07/jenet.pdfIn PDF document text
    • http://www.pirac.org/wp-content/plugins/super-forms/uploads/php/files/1d3182db37bc519e7a3f0bc6336aea0b/xotavapaguj.pdfIn PDF document text
    • https://mongolia-volkslift.com/uploads/files/norezadaz.pdfIn PDF document text
    • http://dom-nenilovo.ru/wp-content/plugins/super-forms/uploads/php/files/b9eb59305cb2218d54236d878e143de7/matuvu.pdfIn PDF document text
    • https://arbormaster.net/uploads/files/dururetiwojobufeniv.pdfIn PDF document text
    • http://lisahyatthealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b07d68a219f---22262764586.pdfIn PDF document text
    • http://cherishedmomentphotos.com/clients/8/84/84fe84b553acfcd191e166b7401b6f02/File/ganipilofawosevotosa.pdfIn PDF document text
    • https://zazilha.com.mx/wp-content/plugins/super-forms/uploads/php/files/cd454a73fdd2a3b40c296b9709cf6c81/30808723841.pdfIn PDF document text
    • https://k-newsletter.com/ckupload/files/nefimeruliwagiluvuvorodi.pdfIn PDF document text
    • https://www.rydalmereprestige.com.au/wp-content/plugins/super-forms/uploads/php/files/tgk10osgf6hf5jqipsupcbpivu/69689424803.pdfIn PDF document text
    • https://www.kngroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071f764e6408---65244567562.pdfIn PDF document text
    • https://przyklejki.pl/userfiles/41829153523.pdfIn PDF document text
    • https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e7bbc900504---86118280147.pdfIn PDF document text
    • http://skikk.be/app/webroot/files/userfiles/files/buvomirawobudukeg.pdfIn PDF document text
    • https://cspdental.com/wp-content/plugins/super-forms/uploads/php/files/b4b5453c7e862046119e7004a995945b/48257424557.pdfIn PDF document text
    • https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/caf0947835a19fa8490392f387080d4d/falofibeliginusasuluj.pdfIn PDF document text
    • https://dmvassociates.com/wp-content/plugins/super-forms/uploads/php/files/7eeebd09374cd9bdd6d63e009b378258/8612719447.pdfIn PDF document text
    • http://hilltop1976.com/clients/24685/File/25709046419.pdfIn PDF document text
    • http://healingpawswisconsin.org/clients/a/a9/a991db820639e3552774ed9a746c1e3b/File/8726160824.pdfIn PDF document text
    • https://laxmigrouppune.com/wp-content/plugins/super-forms/uploads/php/files/cd84d7a59e9a652907a0316c8ff3d433/25769421522.pdfIn PDF document text
    • http://davidlbrooks.com/clients/868292/File/nadazu.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=bread+bakery+business+plan+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f673.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF673 16892 bytes
SHA-256: 8c7a68e7ab7efd147a04309bc2e4df794fcf038eeca03fbe74374ebac7544c99
font_01_sfnt_off00012232.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12232 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013a49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13A49 10772 bytes
SHA-256: ce6a39bc612fb1737ffba99010a96de5c5533f8ccbaefb96354c04adcdbcb052

Open this report in the interactive analyzer, or submit your own file for analysis.