Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad69f8cc092948ae…

MALICIOUS

PDF

91.7 KB Created: 2021-08-16 01:25:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-26
MD5: 0c8e1af982a52fc3ccf89290e7ddab41 SHA-1: 4fa103ae22d8e9b0b39ab12dc3544306834d1747 SHA-256: ad69f8cc092948aefac11a017dd8a5608051631b7331e6925f466f6b25fec737
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or malware distribution intent. It functions as a link farm, containing numerous URLs that point to external resources, likely to lure users into downloading further malicious content or visiting phishing sites. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic suggests these links are designed to manipulate search engine rankings or distribute malware through compromised websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9923

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/uplcv?utm_term=se%C3%B1ora+fazilet+y+sus+hijas+en+espa%C3%B1ol+capitulo+120 PDF link annotation
    • https://shiphangnhanh.net/uploads/image/files/69577554179.pdfIn PDF document text
    • https://netshopnepal.com/userfiles/file/40090953971.pdfIn PDF document text
    • https://csom.cz/wp-content/plugins/super-forms/uploads/php/files/cc68f6f64507154d5bc6145dde69020e/34275688212.pdfIn PDF document text
    • https://amalighting.com/wp-content/plugins/super-forms/uploads/php/files/61f4d348a7238993080535a66c3afdc6/jexufi.pdfIn PDF document text
    • https://gtsonline.nl/wp-content/plugins/super-forms/uploads/php/files/tmgdba5ul30lsb5i4mek4j58s1/63927479270.pdfIn PDF document text
    • https://inchirieriavioane.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160ab14092b2a3---vonugesadidasejige.pdfIn PDF document text
    • https://mamproducciones.es/wp-content/plugins/formcraft/file-upload/server/content/files/16100591dc7d20---80970656578.pdfIn PDF document text
    • http://jeyadhurgatemple.com/userfiles/file/56454055231.pdfIn PDF document text
    • http://zawodydrwali.pl/app/webroot/userfiles/file/jigejekelititamiwa.pdfIn PDF document text
    • https://babamore.com/upload/ckfinder_temp/files/20210601180336.pdfIn PDF document text
    • http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608cd3f11da2a---7611043317.pdfIn PDF document text
    • https://fiambreszav.com/wp-content/plugins/super-forms/uploads/php/files/e5eaa2e56a6582ab00f91062ed2cba76/71324462319.pdfIn PDF document text
    • http://terapie-psi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609616db2174d---gubudijiza.pdfIn PDF document text
    • http://villaturri.com/wp-content/plugins/formcraft/file-upload/server/content/files/161148ce2c22f4---xipazasakomutawosi.pdfIn PDF document text
    • http://palami.by/images/file/56228189391.pdfIn PDF document text
    • http://erkerlaender.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a934474b955---sokexetulurekasikuxem.pdfIn PDF document text
    • http://camelliafb.com/uploads//files/202108051002324125.pdfIn PDF document text
    • https://jdbailbonds.com/wp-content/plugins/super-forms/uploads/php/files/40fcfe98c9c30a82e0938c4707198146/gibelusoduzawu.pdfIn PDF document text
    • http://angelescare.com/userfiles/file/10743552005.pdfIn PDF document text
    • http://phantasos.org/userfiles/file/zimomuzakepanalax.pdfIn PDF document text
    • http://www.rebranded.tv/wp-content/plugins/formcraft/file-upload/server/content/files/160a623205378d---30326290079.pdfIn PDF document text
    • http://cyclad.org/UserFiles/file/70590686972.pdfIn PDF document text
    • https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/adf8008cd14509eb1232c49c27d265c7/narixosoxunexowokipi.pdfIn PDF document text
    • http://air-ned.com/uploads/files/58058630149.pdfIn PDF document text
    • http://colleges-in-tamilnadu.com/FCKeditor/userfiles/file/kogukarupejolusodotom.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000f518.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF518 18148 bytes
SHA-256: 4f3f8e091a93fdf3f21a98944dbea8357089fa73978dfcb2d68cf08dd9528fed
font_00_sfnt_off0000dd07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD07 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00011182.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11182 20180 bytes
SHA-256: a1b641345520c0274e521a1bebbc674a4d77e3fd05e7f1d9e0ca84c5f5176d93
font_03_sfnt_off00014245.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14245 11556 bytes
SHA-256: 75b18d3a053d59408ff6cfcc0f8f3cc7e1c24a9525aa0f5b8d372293eaf7facf

Open this report in the interactive analyzer, or submit your own file for analysis.