Malicious PDF — malware analysis report

Static analysis result for SHA-256 af4709d42630bb05…

MALICIOUS

PDF

71.1 KB Created: 2021-09-05 01:45:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-05
MD5: 2b543a91b7ce730d4595722812780783 SHA-1: a371ba6d6f2d9f1e5e52ddfaed3b66147cc86251 SHA-256: af4709d42630bb05929e9c01ed801c9dc976aaefe9b0c0c2c736e936b1226800
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The heuristics reveal that the document functions as a link farm, directing users to multiple external URLs, some hosted on compromised CMS platforms. The presence of numerous URLs, including those with 'utm_term' parameters, suggests an attempt to lure users to potentially malicious sites for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9893

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/uplcv?utm_term=hf+antenna+book+pdf PDF link annotation
    • https://alkalacarservice.com/public_html/userfiles/file/tomokopun.pdfIn PDF document text
    • http://ctcinsulator.com/uploads/file/79335502035.pdfIn PDF document text
    • https://kicksomeglass.com/wp-content/plugins/super-forms/uploads/php/files/8ecb421a5e4447c381566035384d81aa/12265800875.pdfIn PDF document text
    • http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608bbc90c8217---59536589332.pdfIn PDF document text
    • https://handientu.vn/userfiles/file/67895258953.pdfIn PDF document text
    • https://augsburger-dartliga.de/uploads/file/simijamo.pdfIn PDF document text
    • https://mandalaconfeccao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1610ec27f8d4ba---rebovizofujomowowamur.pdfIn PDF document text
    • https://eol.org.pe/ckfinder/userfiles/files/bibarifiponozedo.pdfIn PDF document text
    • https://dixietemporarystorage.com/wp-content/plugins/super-forms/uploads/php/files/7f727127fa520e568224e58dc3b73923/tojurututuvenisibez.pdfIn PDF document text
    • https://xn--78-6kce7dfhb9dwb.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/bbcee13298fd2a5a5fe0af3928c9e313/17861042488.pdfIn PDF document text
    • https://ddriu.hu/wp-content/plugins/super-forms/uploads/php/files/8566eb8af4a2d0d0869491a16a8ba7c1/julezinejeve.pdfIn PDF document text
    • https://sancarspune.com/wp-content/plugins/super-forms/uploads/php/files/ca3a8e625ddbccf60a8213a45ba12227/26184273175.pdfIn PDF document text
    • https://canvasations.com/wp-content/plugins/super-forms/uploads/php/files/2271b7jr1u93pq0sioffdedtb3/2505281790.pdfIn PDF document text
    • http://oembag.com/uploads/files/202109040350365883.pdfIn PDF document text
    • http://www.guaitoli.eng.br/wp-content/plugins/formcraft/file-upload/server/content/files/160bb79d975712---19079022890.pdfIn PDF document text
    • https://relleno-acidohialuronico.com/wp-content/plugins/super-forms/uploads/php/files/9aba04b2804a522a8febc3a020223550/firuxafo.pdfIn PDF document text
    • https://brandonsmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/vgldq1qsd0ro1bgs2um3a6gs75/kimijuvobu.pdfIn PDF document text
    • https://clickbox.ro/images/file/27305796572.pdfIn PDF document text
    • http://wuxihemei.com/ckfinder/userfiles/files/20210718_111937.pdfIn PDF document text
    • https://westcoastmovers.ca/wp-content/plugins/super-forms/uploads/php/files/iv5m3nfs0n0eq0v3a10i6qumnq/99921982241.pdfIn PDF document text
    • http://www.urbanwaterways.info/files/nazetexuxezetarapipi.pdfIn PDF document text
    • http://dkmmotor.com/files/userfiles/file/27364101188.pdfIn PDF document text
    • https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/foiogvcf30uh10kpldvodc0n4i/3846175793.pdfIn PDF document text
    • https://aronabritcan.com/userfiles/file/79854271653.pdfIn PDF document text
    • https://capital-publishing.com/ckfinder/userfiles/files/bobewugalotoxoxevobuveme.pdfIn PDF document text
    • https://mtydizayn.com/userfiles/file/parutidem.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bb3c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB3C 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000d34e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD34E 14888 bytes
SHA-256: ceed8e65ffd4a3b876eb4fd10b49254151b42aa6fc1042954e21339759fe0a5b
font_02_sfnt_off0000f7b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7B9 10308 bytes
SHA-256: 1c1df8b6a8541f72463c66513dbf3ad7460ed72bb6d7ebcbf955959fdbdf2efd

Open this report in the interactive analyzer, or submit your own file for analysis.