Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1d479dad25d83ae…

MALICIOUS

PDF

103.6 KB Created: 2021-08-04 07:01:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-11
MD5: 0edeb22129e5b6c8eb7441c1bb0167c6 SHA-1: e5a8d170f60a18784a1d6e2857e2b6b72860ed9f SHA-256: b1d479dad25d83ae355ff2b39e5e3f30dae5685a231ce0f998780a383d41c911
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file is identified as malicious by ClamAV and an ML classifier, indicating it likely serves as a phishing lure. The document contains numerous links, many pointing to compromised WordPress sites, which in turn host other PDF files. This behavior suggests a link farm designed to distribute malicious content or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9532

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://reiki-roots.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160bdacb34b0a2---84864053361.pdf In PDF document text
    • https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/64865b6966841e60ae35222b2466009b/14233499371.pdfIn PDF document text
    • https://zweiund40.com/wp-content/plugins/super-forms/uploads/php/files/t7ndbedsqj0iphf7i9q8ue0ljp/tatopawasotawetavirutu.pdfIn PDF document text
    • http://www.tiande-global.com/ckfinder/userfiles/files/nodakagerogidu.pdfIn PDF document text
    • http://nordicaluminium.ru/userfiles/file/59922452535.pdfIn PDF document text
    • http://zentrumok.com/userfile/files/97244274191.pdfIn PDF document text
    • http://oprandi.it/userfiles/files/74925723459.pdfIn PDF document text
    • https://izharfoster.com/wp-content/plugins/formcraft/file-upload/server/content/files/160717670cf373---65466820746.pdfIn PDF document text
    • http://saamfactory.com/wp-content/plugins/super-forms/uploads/php/files/b1959fd60cc9dd12b8f143f04c4c0402/35259600986.pdfIn PDF document text
    • http://www.oschouston.com/osc/wp-content/plugins/formcraft/file-upload/server/content/files/160ac0713bcea8---4575883987.pdfIn PDF document text
    • https://humanistbeauty.com/wp-content/plugins/super-forms/uploads/php/files/iojajbqkt6npj72e6hq8b12pn4/karurakena.pdfIn PDF document text
    • https://www.helmmsp.ca/wp-content/plugins/super-forms/uploads/php/files/f830de4058b54a656840f8efbfe7d230/vepozizebivej.pdfIn PDF document text
    • https://tfnd.org/wp-content/plugins/super-forms/uploads/php/files/81ab8225e12defa1d3b58bfb34151112/fudifazoj.pdfIn PDF document text
    • https://www.spoton.pet/wp-content/plugins/super-forms/uploads/php/files/ptnak8k598410b1bsnacccsmnm/87738845654.pdfIn PDF document text
    • http://dydlhx.com/upfiles/file///4354580288.pdfIn PDF document text
    • http://coeb.eu/userfiles/files/kuted.pdfIn PDF document text
    • http://www.fattyweng.com.sg/wp-content/plugins/formcraft/file-upload/server/content/files/1609df2d863b88---45498002311.pdfIn PDF document text
    • http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c03498992cc---polukulunu.pdfIn PDF document text
    • https://www.cocochan.com.pk/wp-content/plugins/super-forms/uploads/php/files/8900fcdfe524d3c075f2d4fa7da883b6/bofaxunomagesa.pdfIn PDF document text
    • https://aadhaarretail.com/administrator/imagetemp/file/66286236576.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608fc2dd67e50---moxixapopuwitan.pdfIn PDF document text
    • http://lookkorea.net/userfiles/file/72189081452.pdfIn PDF document text
    • https://2greenchicks.com/wp-content/plugins/super-forms/uploads/php/files/7dd4b017e29318ce63f6a950c9e0e159/39457473032.pdfIn PDF document text
    • http://kevinmcallisterlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/jetulilelakerajosut.pdfIn PDF document text
    • https://xn--80adj7cxa.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/607c1ccb311190936a831ece475ebf47/potoz.pdfIn PDF document text
    • https://eandjfamilyhealthcenter.com/wp-content/plugins/super-forms/uploads/php/files/c4d38bc8d119d029b1da022c93303db1/76079901737.pdfIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/cv9VXjIrmdE/uplcv?utm_term=yugioh+legacy+of+the+duelist+good+deck+buildsPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000113d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113D7 18344 bytes
SHA-256: 87727b418db2e6d7690c9b468a7649462afaa5ce72099e4c51f5a92e0857f215
font_01_sfnt_off000143f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143F2 10980 bytes
SHA-256: e2d850511500ec8e75d97da086933305b8754e544a44593243484e3fcecb48df
font_02_sfnt_off00015d5b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15D5B 6536 bytes
SHA-256: 5cb9705537e49f2c441ba3eeb18d29929cd1707977a82f2476f745faaf37d634
font_03_sfnt_off000174dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x174DC 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.