Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0e074887d54f482…

MALICIOUS

PDF

105.6 KB Created: 2021-06-28 23:44:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 070636d90e9df0dff06d5a5ce0286119 SHA-1: a6f679b4d858546d60cb8b19481f83382f29108d SHA-256: b0e074887d54f482dc59f49fc08e72f11857caa872b475f1b7ce1d297819ebbd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier as malicious. It contains a large number of links, many pointing to compromised WordPress upload storage and disposable hosting, suggesting it functions as a link farm. The primary purpose appears to be redirecting users to potentially malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9806

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bnovum.hu/downloads/kixoxodekaxipijujatu.pdf
    • https://www.adelaarenergy.com/wp-content/plugins/super-forms/uploads/php/files/l2qjla3v85sg7vkt4ekjiprp5j/berefozilumefizov.pdf
    • https://classykitchen.pl/web/uploads/files/sekipukiteno.pdf
    • http://driver-jazda.pl/upload/file/dadujuwonu.pdf
    • https://2greenchicks.com/wp-content/plugins/super-forms/uploads/php/files/b6b330e4be5615bba86fb10d286e65df/natefemewavofizijuzi.pdf
    • http://www.melloecastro.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f75cea7ac2---33893231089.pdf
    • http://vibrosystem.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160c1285c28899---9505463199.pdf
    • https://mvmdigital.gr/files/files/tisulukobevizamemoxilaji.pdf
    • https://razdolle.by/wp-content/plugins/super-forms/uploads/php/files/c07i88uhie41n8bn7k732gt7c7/34358389787.pdf
    • https://chamsocmuihong.com/wp-content/plugins/super-forms/uploads/php/files/hnj4bjlta00abjta6mudg4ki7c/faxarimudofapumuto.pdf
    • https://www.hotwaterfactory.com.au/wp-content/plugins/super-forms/uploads/php/files/a2fc94f3a763c23842789099a1e01d94/3242727429.pdf
    • https://www.fifatravels.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bfb6c27582---puxemeporatomuwimu.pdf
    • http://oneself.pro/wp-content/plugins/formcraft/file-upload/server/content/files/160b890033fe00---sopuwotizibuj.pdf
    • http://www.trimbleexpress.sk/wp-content/plugins/formcraft/file-upload/server/content/files/1607e8e6cbe7fd---zomazeduga.pdf
    • https://loan-financial.com/wp-content/plugins/super-forms/uploads/php/files/ca200367f6bad374ab11d5de175c4388/28290011682.pdf
    • http://gsoam.ge/wp-content/plugins/formcraft/file-upload/server/content/files/160b447d12919a---fumuxexibevoko.pdf
    • http://prospekt-rostov.ru/ckfinder/userfiles/files/pikumolu.pdf
    • http://berallebags.com/UploadFiles/FCKeditor/20210516234818.pdf
    • http://bochosushi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a79fc59f7ec---34926381341.pdf
    • https://www.certificagreen.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ff59a03da6---31162202317.pdf
    • http://evevoyance.fr/adh/.-/file/45686804469.pdf
    • https://gauravkankariya.com/wp-content/plugins/super-forms/uploads/php/files/li41pr18q9rjdr9eppoj060tl0/gasiwonu.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=what+is+the+meaning+of+supercalifragilistic
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00017737.bin
5468820ae44d7363d45d7418eebbfb27dd485edd4425ed17458088a154df578f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x17737 19704 bytes
font_00_sfnt_off0000ec36.bin
c53b92e57083039ef9c3bb580281598895c79aa11f5f69010486db54fa404907		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC36 5420 bytes
font_01_sfnt_off0000ff9f.bin
00c14a62e281f1916fe3c5766cf5810c1773884c622129fa5cf5e528a81ce950		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF9F 29692 bytes
font_02_sfnt_off000145ab.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x145AB 16792 bytes
font_03_sfnt_off00015dc2.bin
d59160b90ae464216a0ad1a8bd93dade305bffbce3e7b6d8d476173dc545838b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15DC2 11020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.