Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0238733a658b40c…

MALICIOUS

PDF

85.8 KB Created: 2021-07-08 19:18:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 105c11ac5b6e4f6624692d331a85cfb3 SHA-1: e97c9c8b32e61335e96bb7d9b814982af8b7fbce SHA-256: b0238733a658b40c2fe219255401583d45f214497d37f306169c88303a7f9fc1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by ClamAV as 'Pdf.Phishing.Trojan' and an ML classifier indicated a high probability of maliciousness. Heuristics identified it as a link farm pointing to compromised CMS upload storage and disposable hosting, suggesting an attempt to redirect users to malicious sites. The embedded URLs, such as http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/160998e73742b4---54925926313.pdf, are likely used for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9952

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://stagerightstaging.com/wp-content/plugins/super-forms/uploads/php/files/fd866975be42271bb6c8e5dae38fcf97/58341475280.pdf
    • http://www.jcca.co.in/wp-content/plugins/formcraft/file-upload/server/content/files/1608f21e4793b0---62422058596.pdf
    • https://www.wikiwebagency.it/wp-content/plugins/super-forms/uploads/php/files/dd4f0b0864c8d8fe706713cba2c7426f/56641542735.pdf
    • https://aimara-bg.com/userfiles/file/94589605660.pdf
    • https://tehnol.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160af949fa34de---nujepotumelupuzaj.pdf
    • https://belhasasecurity.com/userfiles/file/44383411044.pdf
    • http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/160998e73742b4---54925926313.pdf
    • https://www.mozartcantat.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609faaa2c5050---wupifidumito.pdf
    • http://yatros.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b63b1233e90---nuramazekapefikivuwireso.pdf
    • http://quangcaosms.org/media/ftp/file/76316662543.pdf
    • https://sip7.pl/autoinstalator/sip7.online/wp-content/plugins/super-forms/uploads/php/files/86166f0e7011616fd745a466cb2ce8f4/gatanig.pdf
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d97188bec2b---nozexeduvosav.pdf
    • https://accu-split.com/userfiles/files/jovowegi.pdf
    • http://constructionone.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160793c965577a---dewobuzazegisexafemif.pdf
    • https://afriqueitnews.com/wp-content/plugins/super-forms/uploads/php/files/1cf1524a0f8dbd01969576a68360d777/52088987882.pdf
    • http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160a523971ce77---judizilunorisar.pdf
    • http://antik-cafe-bergen.de/wp-content/plugins/formcraft/file-upload/server/content/files/160df4b7ccbecb---wilufekirenagegisa.pdf
    • https://glasschneider.koeln/wp-content/plugins/super-forms/uploads/php/files/0p9ne9heib0glu88roce4e427n/silitufekusufix.pdf
    • http://lushexperiences.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ee9b92ff72---83148357439.pdf
    • http://pansophers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160db0d23da74d---bobipoxa.pdf
    • http://coss-wynn-reunion.com/clients/d/db/dbe3622004495b304d8703879a486b7d/File/gebofupefak.pdf
    • http://kaies.cn/upfiles/210602175350383434isn4tz.pdf
    • https://liniagdanskzydowo.pl/files/45092437005.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=turgor+pressure+meaning
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efc6.bin
9bb2793a5cf4a9f68d0b9b50c2501c484f97621c22ef38893fd9f3bd6b674f9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFC6 10516 bytes
font_01_sfnt_off000107a4.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107A4 16792 bytes
font_02_sfnt_off00011fb6.bin
a08b9c06262dea6d91aa9e2b83f3f694c52bc1d041646492176e60ff051f3f49		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FB6 16576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.