Malicious PDF — malware analysis report

Static analysis result for SHA-256 b160306d799769a6…

MALICIOUS

PDF

97.3 KB Created: 2021-06-18 21:12:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 74bbd78076f3fa68e2ead19e23652f1f SHA-1: de0675a9f331bfb780f96c771fb18c0cc34a382d SHA-256: b160306d799769a68c8abfaba0bf4153ce9c7463937c8e4d976d6c0ad63fa5b9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. Heuristics indicate the PDF acts as a link farm, pointing to various compromised WordPress upload storage locations and disposable hosting sites, suggesting it's used to distribute further malicious content or phish for information. The document body, though heavily obfuscated, contains text related to downloading and application versions, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ahlhy.com/uploads/file/042229471333.pdf In PDF document text
    • http://www.odnpoznan.pl/fotki/file/file/jiziron.pdfIn PDF document text
    • http://campbellelectronics.com/uploads/29128325220.pdfIn PDF document text
    • http://baugeraeteverleih.de/benutzerdateien/16317528398.pdfIn PDF document text
    • https://adbadog.com/wp-content/plugins/super-forms/uploads/php/files/f56eb636237ee47d14cb466e26bd35e4/22459586288.pdfIn PDF document text
    • https://bizdrive.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160b38f5bdca44---81670126472.pdfIn PDF document text
    • http://nappsa.org/userfiles/file/dokubujovixuditapilofi.pdfIn PDF document text
    • http://animalscipublisher.com/files/upfiles/file/sipibifulesos.pdfIn PDF document text
    • https://wscnaturalhealings.com/wp-content/plugins/super-forms/uploads/php/files/afa3416b00b5105ee9aa52c3d565e368/90621018107.pdfIn PDF document text
    • http://modnyi-buket.ru/uploads/files/64663372574.pdfIn PDF document text
    • https://www.enterpriselighting.com/wp-content/plugins/super-forms/uploads/php/files/19b77bf55dba86994b451334f81d3ad4/57597191919.pdfIn PDF document text
    • http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160a45f502a2b9---wepilon.pdfIn PDF document text
    • https://www.costaverde.it/wp-content/plugins/formcraft/file-upload/server/content/files/16097f978ce7c1---71522034646.pdfIn PDF document text
    • https://aedwea.com/upload/foto/vedopibemilamuj.pdfIn PDF document text
    • http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607f7b6824ab9---zuvalugifezafamowazeruzi.pdfIn PDF document text
    • https://trsbarriersdirect.com/wp-content/plugins/super-forms/uploads/php/files/kfp7078cdbgctjtfbj98hbs21h/pavamem.pdfIn PDF document text
    • http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608059266cb2d---60754023820.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=download+yalla+shootPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00013f5c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13F5C 31252 bytes
SHA-256: a185cfb06779a3531d75090b9bec54107942126ea8737882d8aa78fd3d52aae1
font_00_sfnt_off0001084a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1084A 5008 bytes
SHA-256: d98bae510ddf88d109146e02bead82abe4d09df882142e0ee1db47cf199baee6
font_01_sfnt_off0001196e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1196E 11028 bytes
SHA-256: 55900050f45da4facad06346452ccf36d46e07156d282312b93496aa76687ce1

Open this report in the interactive analyzer, or submit your own file for analysis.