Malicious PDF — malware analysis report

Static analysis result for SHA-256 af099ea69cb2f6a7…

MALICIOUS

PDF

85.1 KB Created: 2021-07-13 20:20:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-09-15
MD5: 4d07112b8cc5d5bff70d17bc0221571d SHA-1: 89a427cc1ed6f41d1269c3194d98ba9b1b7a03da SHA-256: af099ea69cb2f6a7f12c844acc8bc7ff613b3f1871014c95e62f40e5adc8cecb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. Heuristics indicate the document functions as a link farm, directing users to multiple compromised or potentially malicious websites. The presence of numerous unknown URLs suggests an attempt to distribute malware or conduct phishing operations.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.tecnotrefg.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608b3eba01240---nuvagibo.pdf In PDF document text
    • http://beachfirebrands.com/userfiles/file/8684849250.pdfIn PDF document text
    • http://drstevealbrecht.com/wp-content/plugins/super-forms/uploads/php/files/8ac59b940bac348c1d0b12ff6b7fc160/31846699613.pdfIn PDF document text
    • https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/028b48c93d234219b85355fad63f7de9/76872178507.pdfIn PDF document text
    • http://connect-senior.ch/uploades/userfiles/file/tamotuze.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160873ed7763f5---1248946489.pdfIn PDF document text
    • http://reikihaus.com/clients/75291/File/16575448893.pdfIn PDF document text
    • http://tipsclubcr.com/campannas/file/jimijotekifenurezalorin.pdfIn PDF document text
    • http://busankid.com/webfiles/board/file///vesobogowad.pdfIn PDF document text
    • http://anhuifan.com/upload_fck/file/2021-5-8/20210508061258866475.pdfIn PDF document text
    • https://skazkavdom.com/wp-content/plugins/super-forms/uploads/php/files/d4b006cbd798d623d4ca1b813bd66e67/zefevisivizuza.pdfIn PDF document text
    • http://katheran.com/clients/55933/File/34836049690.pdfIn PDF document text
    • https://www.shopveriamici.com/wp-content/plugins/super-forms/uploads/php/files/8qamof69aje7j69em08ktlondj/tewageli.pdfIn PDF document text
    • http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c75600daa4---37849790133.pdfIn PDF document text
    • http://www.ashtralmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160769dd5f14d7---63309015630.pdfIn PDF document text
    • http://elskenecologie.nl/files/pigar.pdfIn PDF document text
    • http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/1607ac518f1ffe---76416067677.pdfIn PDF document text
    • https://fertilizergranulatorprice.com/d/files/dovetijolagowumulotofar.pdfIn PDF document text
    • https://brokenspoke.com/wp-content/plugins/super-forms/uploads/php/files/3d63730638a8d6c91f4a759bf88a5489/jabezobutinisedawabotibol.pdfIn PDF document text
    • https://amblamy.ee/upload/file/pizig.pdfIn PDF document text
    • http://msamerica.net/clients/873634/File/83081704636.pdfIn PDF document text
    • https://drainscovers.com/wp-content/plugins/super-forms/uploads/php/files/e9bd27ea990a5c75bfc8f56b45371c0a/95664480718.pdfIn PDF document text
    • https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/klcovr4ds78jn6dhiitp7n99ak/7807689501.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=american+cars+with+manual+transmissionPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eba4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBA4 10660 bytes
SHA-256: c2cf803d86a0a179edfb085754fbc0d43fc9063c5f2cd57ef1ab2b84751d5412
font_01_sfnt_off000103f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103F0 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00011c02.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C02 16636 bytes
SHA-256: 9607a55e19b0ade21ad26e350a772bf7af897e888c789e7cb57c6e36482d67e3

Open this report in the interactive analyzer, or submit your own file for analysis.