Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3c1a85095604188…

MALICIOUS

PDF

77.0 KB Created: 2021-09-02 02:57:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: b84fc74b64604159097f8edffedac76d SHA-1: 336a9a193aa658fdd553dc8dd0a45dff746b5450 SHA-256: b3c1a85095604188c642a35af9434909b432449156d2283e9e88fed6fddf4a03
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by ClamAV as a phishing trojan and by an ML classifier as malicious. It contains numerous external links, many of which point to compromised WordPress sites, suggesting a phishing or malicious redirection scheme. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates a large number of links designed for SEO manipulation or to distribute malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bmat.mn/uploads/ckfinder/files/62106788771.pdf In PDF document text
    • http://mesotects.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b427b876e02---gubezejuserifo.pdfIn PDF document text
    • https://iescolumbus.org/wp-content/plugins/super-forms/uploads/php/files/5dce68ca4a43a8531304d64db91a9a16/liranebofiwase.pdfIn PDF document text
    • https://dipinkrishna.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607eae042f28c---80271102156.pdfIn PDF document text
    • http://johnlillylaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/fazasurasogofixila.pdfIn PDF document text
    • http://duonglaohanoi.com/userfiles/file/48337483627.pdfIn PDF document text
    • http://vietsonplastic.com/uploads/userfiles/file/mosajixujozafekunazud.pdfIn PDF document text
    • https://tocgia247.com/wp-content/plugins/super-forms/uploads/php/files/49t7h747k7il9kafo93u6i8e84/98820236581.pdfIn PDF document text
    • https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/qndnhfp6sc6pmtss8q8tunkmp1/venororamelikosebaxanopo.pdfIn PDF document text
    • https://www.americanapi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160703a31497ea---30782859578.pdfIn PDF document text
    • http://www.firstpages.eu/app/webroot/files/userfiles/files/55656982859.pdfIn PDF document text
    • https://home-consult.lu/userfiles/files/41697798442.pdfIn PDF document text
    • http://www.heatandgas.com/EditorImages/file/lokiwo.pdfIn PDF document text
    • http://andlupa.com/userfiles/file/25073329442.pdfIn PDF document text
    • https://dbhattacharjee.com/ckfinder/userfiles/files/babuvozudoweditevab.pdfIn PDF document text
    • https://htfcompact.com/wp-content/plugins/super-forms/uploads/php/files/41ebaea635efef39c17372273a2f45b9/gagexam.pdfIn PDF document text
    • http://dabaizhongxue.com/upload_fck/file/2021-8-19/20210819041922475231.pdfIn PDF document text
    • https://chung-pei.com/userfiles/file/5788851984.pdfIn PDF document text
    • http://alexhofford.com/temp/files/file/vedibot.pdfIn PDF document text
    • http://brianhaymore.com/images/e/file/fubegifinisazebosibad.pdfIn PDF document text
    • https://economiadecomunion.net/ckfinder/userfiles/files/86763266321.pdfIn PDF document text
    • http://bilagroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a87567d80de---16724318071.pdfIn PDF document text
    • http://scamps.biz/userfiles/file/6905780742.pdfIn PDF document text
    • http://dtyxbpzx.com/filespath/files/20210831182837.pdfIn PDF document text
    • http://szzxwx.com/Upload/Upload/file/20215281245559838.pdfIn PDF document text
    • http://www.alfainstal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16096057ee7596---levesemak.pdfIn PDF document text
    • https://amalighting.com/wp-content/plugins/super-forms/uploads/php/files/f568b46094dbbf7510cc300bf9555a2b/24531350570.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=speed+queen+commercial+washer+wash+timePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c7ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC7AC 11188 bytes
SHA-256: c547abc14f0b24d157ee564a5b6e68925cece24752ef1fe877acaecb134c91cb
font_01_sfnt_off0000e16e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE16E 17064 bytes
SHA-256: 229dfeee0c396b3d99f01f8b4987ca218ee81334c51b280ac97b562347a992cd
font_02_sfnt_off00010dc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DC2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.