Malicious PDF — malware analysis report

Static analysis result for SHA-256 b596c230acaa094a…

MALICIOUS

PDF

90.1 KB Created: 2021-07-16 01:20:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-12
MD5: e7e8de05ef0bf2999314db94e2969cbf SHA-1: 2aa2974210051c0568ccf187b56ccd2859825d1f SHA-256: b596c230acaa094a0b33b3673d4e22afb7b6d106f556c3492f26ddfd099e52e5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, containing numerous URLs pointing to compromised WordPress sites, likely intended to redirect users to phishing or malware distribution pages. The presence of multiple PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.garriagricola.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd67c985ebc---65235393781.pdf In PDF document text
    • https://yarsan.ru/wp-content/plugins/super-forms/uploads/php/files/a76cdb0470ea644c289700c05a2accc0/49150216605.pdfIn PDF document text
    • http://argentum.com/wp-content/plugins/super-forms/uploads/php/files/rkbkcg4va7ib57ht6bstsclhj8/92824397158.pdfIn PDF document text
    • https://beaufortbond.com/wp-content/plugins/super-forms/uploads/php/files/e38efcac6f3e6bfda217208cf356b447/fimezidixozekigu.pdfIn PDF document text
    • http://asupuro.com/user_data/image//file/79418511776.pdfIn PDF document text
    • https://scavilecis.it/userfiles/file/46305707299.pdfIn PDF document text
    • http://associacaoguainumbi.org.br/wp/wp-content/plugins/formcraft/file-upload/server/content/files/16075856355ca5---74502601846.pdfIn PDF document text
    • http://www.icodar.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076695f70ece---tipapaseniwaj.pdfIn PDF document text
    • https://pyhm.ca/wp-content/plugins/super-forms/uploads/php/files/152jhh2mm8dtuo424hraogf3tg/dogevek.pdfIn PDF document text
    • https://ethiquedevelopers.com/wp-content/plugins/super-forms/uploads/php/files/559dfb94ba023c55ba412efd0b0dd96b/86167874465.pdfIn PDF document text
    • https://drahmetbostanci.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609d1bb8b5e98---muzozuwojujujumajel.pdfIn PDF document text
    • https://a2designbg.com/userfiles/file/sesijizorelosip.pdfIn PDF document text
    • http://www.1atlanticfunding.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b48b112343c---13073878008.pdfIn PDF document text
    • https://borderpak.com/wp-content/plugins/super-forms/uploads/php/files/6a2f1a7a25be9e22d526afbde7447d49/31228749239.pdfIn PDF document text
    • http://electrogalicia.com/electrogalicia/recursos/archivos/25699828564.pdfIn PDF document text
    • http://bitite.lv/media/txt/122/file/80995554891.pdfIn PDF document text
    • http://aihyang.com/userfiles/file/nenefasunojonojijeduvez.pdfIn PDF document text
    • http://nuyewrecruitment.com/wp-content/plugins/super-forms/uploads/php/files/9061b8f742a7ae3f20726130ac6836f9/vejaxozomafod.pdfIn PDF document text
    • https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/dec316e93576dc5777cee0c0faf363de/kuwiteda.pdfIn PDF document text
    • http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/16098416588475---91133706032.pdfIn PDF document text
    • http://branpc.in/ckfinder/userfiles/files/vitewumifijobowujez.pdfIn PDF document text
    • https://www.hungryalex.com/wp-content/plugins/super-forms/uploads/php/files/olp0e51qm6be851p9anp2t1r24/23997330259.pdfIn PDF document text
    • http://bajajsports.com/userfiles/file/polujasobuzorolizose.pdfIn PDF document text
    • http://ballarioarchitetti.eu/userfiles/files/kikezunerili.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=fool+funny+quotesPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff53.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF53 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00011765.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11765 17372 bytes
SHA-256: f49483bdd3fcea05027ebeefaef5ce27cc944e6fa24fa82558429655baabffb1
font_02_sfnt_off00014451.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14451 10188 bytes
SHA-256: 9d3ce41a4fe3bc89e648cb29695396519b888f6656664b1da3980e57c10f0193

Open this report in the interactive analyzer, or submit your own file for analysis.